Count comma delimited field

[neileosis]

I am trying to get counts based on comma delimited values for specified groupings of events.

For instance I have the following logs.

Event=A Ids="55,32,5"
Event=A Ids="55"
Event=B Ids="56,63"
Event=C Ids="23,53,12"
Event=C Ids="39,6"

I want the data to show up in a table like the following

Event A&B	Event C
6	5

How would I craft the query to get it to aggregate it like this? 

Note: This would be happening for a large number of events.

[bowesmana · Accepted solution]

This example gives you what you want - however, I have used simple logic to know that A and B need to be combined - you will have to address that grouping as you need.

This example can be pasted to the splunk search. All up to the table Ids is setting up your example data

| makeresults
| eval events="Event=A Ids=\"55,32,5\"##Event=A Ids=\"55\"##Event=B Ids=\"56,63\"##Event=C Ids=\"23,53,12\"##Event=C Ids=\"39,6\""
| makemv delim="##" events
| mvexpand events
| rename events as _raw
| extract
| table Event Ids
| eval Ids=split(Ids,",")
| eval EventGroup=if(Event="C", Event, "A&B")
| stats count(Ids) as idc by EventGroup
| transpose header_field=EventGroup
| fields - column

Hope this helps

[neileosis]

Thanks so much! This works as needed.