Splunk Search

Hi Experts, I would like to count the multifield in the table where it has similar values

Ashwini_5
Explorer

I would like to count the multifield in the table where it has similar values. 

For Ex:  I need output like below for the COMPLETED_CERT_COUNT, It should only show the count of NOT_Expired training status. 

Ashwini_5_0-1642787628604.png

 

I have tried |eval COMPLETED_CERT_COUNT=mvcount(if(TRAINING_STATUS=="Not_Expired")) and

 

| stats mvcount(eval(TRAINING_STATUS="Not_Expired")) as certcount by name . But Nothing worked out. Kindly share your suggestion 

Labels (1)
Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

|eval COMPLETED_CERT_COUNT=mvcount(mvfilter(match(TRAINING_STATUS,"Not_Expired"))) 
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You could try to user mvexpand to expand the training_status and then do a stats count(eval(TRAINING_STATUS="Not_Expired")) as certcount by name

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...