Count occurences of same ticket number in a multivalue field

[timyong80]

Hello guys,

I am trying to count the number of times the same ticket number appears in a multi-value field. The ticket number represents a new case opened by IT Support when a problem occurs. Example:

Ticket_Number Occurences

IT90987 1
IT89332 2
IT43015 1
IT89332 1
IT11122 1

Is there a way to do that?

Your help is much appreciated. Thank you.

[cmerriman]

try something like this:

|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number

if you have other fields in your search you need to keep, maybe tack that into an appendpipe.

...|appendpipe [|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number anyOtherImportantFields|eval Ticket_NumberOccurrences=Ticket_Number+"-"+Occurences]|stats values(Ticket_NumberOccurrences) as Ticket_NumberOccurrences list/values(anyOtherFields) as anyOtherFields by anyOtherImportantFields