Hello guys,
I am trying to count the number of times the same ticket number appears in a multi-value field. The ticket number represents a new case opened by IT Support when a problem occurs. Example:
IT90987 1
IT89332 2
IT43015 1
IT89332 1
IT11122 1
Is there a way to do that?
Your help is much appreciated. Thank you.
try something like this:
|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number
if you have other fields in your search you need to keep, maybe tack that into an appendpipe.
...|appendpipe [|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number anyOtherImportantFields|eval Ticket_NumberOccurrences=Ticket_Number+"-"+Occurences]|stats values(Ticket_NumberOccurrences) as Ticket_NumberOccurrences list/values(anyOtherFields) as anyOtherFields by anyOtherImportantFields