Splunk Search

Hi Experts, I would like to count the multifield in the table where it has similar values

Ashwini_5
Explorer

I would like to count the multifield in the table where it has similar values. 

For Ex:  I need output like below for the COMPLETED_CERT_COUNT, It should only show the count of NOT_Expired training status. 

Ashwini_5_0-1642787628604.png

 

I have tried |eval COMPLETED_CERT_COUNT=mvcount(if(TRAINING_STATUS=="Not_Expired")) and

 

| stats mvcount(eval(TRAINING_STATUS="Not_Expired")) as certcount by name . But Nothing worked out. Kindly share your suggestion 

Labels (1)
Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

|eval COMPLETED_CERT_COUNT=mvcount(mvfilter(match(TRAINING_STATUS,"Not_Expired"))) 
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You could try to user mvexpand to expand the training_status and then do a stats count(eval(TRAINING_STATUS="Not_Expired")) as certcount by name

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...