Splunk Search

Count of values in a multi-value field

hpendela
New Member

Log lines:
k1=doesn't matter, k2=doesn't matter, k3=[v3, v4]
k1=doesn't matter, k2=doesn't matter, k3=[v5, v4, v6]
k1=doesn't matter, k2=doesn't matter, k3=[v5, v6, v9, v4]

Expected output:

v4 => 3
v5 => 2
v6 => 2
v3 => 1
v9 => 1

0 Karma

vnravikumar
Champion

Hi @hpendela

Please try

| makeresults 
| eval log="k1=doesn't matter, k2=doesn't matter, k3=[v3, v4];
k1=doesn't matter, k2=doesn't matter, k3=[v5, v4, v6];
k1=doesn't matter, k2=doesn't matter, k3=[v5, v6, v9, v4]" 
| makemv delim=";" log 
| mvexpand log 
| rex field=log "k3=\[(?P<k3>(.*))]" 
| makemv delim="," k3 
| eval k3= ltrim(k3) 
| stats count by k3
0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@hpendela,

Try

"your base search" | rex field=k3 max_match=0 (?<vals>\w\d+)|stats count by vals

If you have more than one character in v , change the grouping part as (?<vals>\w+\d+)

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...