Splunk Search
Highlighted

Help with multivalue field count

Builder

Hello,

I have a multivalue field with two values.

segment_status:

SUCCEEDED-1234333

FAILED-34555

I am trying to get the total of segment status and individual count of Succeeded and FAILED

for the total count I have done the below query

eventtype=abc ... segmentstatus=*
| eval abc=mvcount(segment
status) |stats sum(abc) as "Total"--this gives me the correct total of both succeded and failed. but I am not able to get the individual count of succesded and failed.

this is the query i tried
eventtype=abc ... segmentstatus=SUCCEEDED
| eval success=mvcount(segment
status) |stats sum(abc) as "Total" -- this is again giving me the total count but not for success.

Thanks in advance

0 Karma
Highlighted

Re: Help with multivalue field count

Champion

Try this:

| eval succeeded=mvfilter(match(segment_status, "SUCCEEDED"))
| eval failed=mvfilter(match(segment_status, "FAILED"))
| stats count(succeeded) AS succeeded_count, count(failed) AS failed_count

View solution in original post

Highlighted

Re: Help with multivalue field count

Builder

it says Error in 'eval' command: The expression is malformed. Expected ).

0 Karma
Highlighted

Re: Help with multivalue field count

Builder

I just added a bracket and it worked

| eval succeeded=mvfilter(match(segmentstatus, "SUCCEEDED")) | eval failed=mvfilter(match(segmentstatus, "FAILED")) | stats count(succeeded) AS succeededcount, count(failed) AS failedcount

Thnks

0 Karma
Highlighted

Re: Help with multivalue field count

Motivator

Ty! I did this for counting internal and external recipientdomains, where recipientdomain is an mv field.

eval count_internal=mvcount(mvfilter(match(recipient_domain, "abc.com")))
and
eval count_external=mvcount(mvfilter(!match(recipient_domain, "abc.com")))

0 Karma
Highlighted

Re: Help with multivalue field count

SplunkTrust
SplunkTrust

Give this a try

eventtype=abc ... segment_status=*
| eval SUCCEEDED=if(isnotnull(mvfind(match(segment_status,"SUCCEEDED"))),1,0)
| eval FAILED=if(isnotnull(mvfind(match(segment_status,"FAILED"))),1,0)
| stats sum(FAILED) as FAILED sum(SUCCEEDED) as SUCCEEDED count as Total
0 Karma
Highlighted

Re: Help with multivalue field count

Builder

It shows error

Error in 'eval' command: The expression is malformed. Expected ).

0 Karma
Highlighted

Re: Help with multivalue field count

Champion

Oops, edited to correct that. 🙂

0 Karma
Highlighted

Re: Help with multivalue field count

SplunkTrust
SplunkTrust

Hi @vrmandadi ,

Can you please try this one ?

eventtype=abc ... segment_status=*
| stats sum(eval(like(segment_status,"%FAILED%"))) as FAILED_COUNT sum(eval(like(segment_status,"%SUCCEEDED%"))) as SUCCEEDED_COUNT

My Sample Search:

| makeresults 
| eval segment_status="SUCCEEDED-1234333,FAILED-34555" 
| makemv delim="," segment_status 
| append 
    [| makeresults 
    | eval segment_status="SUCCEEDED-1234333,FAILED-34555" 
    | makemv delim="," segment_status] 
| append 
    [| makeresults 
    | eval segment_status="SUCCEEDED-1234333" 
    | makemv delim="," segment_status] 
| append 
    [| makeresults 
    | eval segment_status="FAILED-34555" 
    | makemv delim="," segment_status] 
| append 
    [| makeresults 
    | eval segment_status="FAILED-34555" 
    | makemv delim="," segment_status] 
| stats sum(eval(like(segment_status,"%FAILED%"))) as FAILED_COUNT sum(eval(like(segment_status,"%SUCCEEDED%"))) as SUCCEEDED_COUNT

Thanks
Kamlesh

0 Karma
Highlighted

Re: Help with multivalue field count

Builder

Hey kamlesh,

I tried your search but the results are not correct

0 Karma