Compare multi value fields to get Count

[Shashank_87]

Hi, I have a multi value field which contains some product codes separated by a code. Now the 2 events can have the same combination but they are jumbled for example -
A|B|C|E|D and A|B|D|E|C.
I want them to be counted as one. Please if someone can help how to do this.

[DalJeanis · Accepted solution]

This code will sort the values that are in myfield into a consistent order.

| makemv myfield delim="|"
| eval myfield=mvsort(myfield)
| eval myfield=mvcombine(myfield,"|")

If for some reason you need to maintain the original order as well, then just put it into a different field name before you start.

| eval myfield2=myfield
| makemv myfield2 delim="|"
| eval myfield2=mvsort(myfield2)
| eval myfield2=mvcombine(myfield2,"|")

You can also do it in a single command by using split instead of makemv, and stringing each of the operations all together from the inside out.

| eval myfield2=mvcombine(mvsort(split(myfield,"|")),"|")

[Shashank_87]

Thanks Dal. This worked perfectly fine after a bit modifications in my query. I was actually using the mvsort command but with Pipe and I believe that's why it wasn't able to sort it. 🙂

[jlvix1]

Post a raw event please... Are you saying that a single field X is formed as X=A|B|C|D|E using pipes?

[Shashank_87]

Yes. Example : A|B|C|E|D is from one of the event of field X and A|B|D|E|C could be another events of the same field X. Though they are same codes but they are jumbled. What I am looking for is when I count it kit should come as 2 (or whatever the number is) not 1.