Splunk Search

Compare multi value fields to get Count

Explorer

Hi, I have a multi value field which contains some product codes separated by a code. Now the 2 events can have the same combination but they are jumbled for example -
A|B|C|E|D and A|B|D|E|C.
I want them to be counted as one. Please if someone can help how to do this.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

This code will sort the values that are in myfield into a consistent order.

| makemv myfield delim="|"
| eval myfield=mvsort(myfield)
| eval myfield=mvcombine(myfield,"|")

If for some reason you need to maintain the original order as well, then just put it into a different field name before you start.

| eval myfield2=myfield
| makemv myfield2 delim="|"
| eval myfield2=mvsort(myfield2)
| eval myfield2=mvcombine(myfield2,"|")

You can also do it in a single command by using split instead of makemv, and stringing each of the operations all together from the inside out.

| eval myfield2=mvcombine(mvsort(split(myfield,"|")),"|")

View solution in original post

SplunkTrust
SplunkTrust

This code will sort the values that are in myfield into a consistent order.

| makemv myfield delim="|"
| eval myfield=mvsort(myfield)
| eval myfield=mvcombine(myfield,"|")

If for some reason you need to maintain the original order as well, then just put it into a different field name before you start.

| eval myfield2=myfield
| makemv myfield2 delim="|"
| eval myfield2=mvsort(myfield2)
| eval myfield2=mvcombine(myfield2,"|")

You can also do it in a single command by using split instead of makemv, and stringing each of the operations all together from the inside out.

| eval myfield2=mvcombine(mvsort(split(myfield,"|")),"|")

View solution in original post

Explorer

Thanks Dal. This worked perfectly fine after a bit modifications in my query. I was actually using the mvsort command but with Pipe and I believe that's why it wasn't able to sort it. 🙂

0 Karma

Communicator

Post a raw event please... Are you saying that a single field X is formed as X=A|B|C|D|E using pipes?

0 Karma

Explorer

Yes. Example : A|B|C|E|D is from one of the event of field X and A|B|D|E|C could be another events of the same field X. Though they are same codes but they are jumbled. What I am looking for is when I count it kit should come as 2 (or whatever the number is) not 1.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!