I would like to count the multifield in the table where it has similar values.
For Ex: I need output like below for the COMPLETED_CERT_COUNT, It should only show the count of NOT_Expired training status.
I have tried |eval COMPLETED_CERT_COUNT=mvcount(if(TRAINING_STATUS=="Not_Expired")) and
| stats mvcount(eval(TRAINING_STATUS="Not_Expired")) as certcount by name . But Nothing worked out. Kindly share your suggestion
Try something like this
|eval COMPLETED_CERT_COUNT=mvcount(mvfilter(match(TRAINING_STATUS,"Not_Expired")))
You could try to user mvexpand to expand the training_status and then do a stats count(eval(TRAINING_STATUS="Not_Expired")) as certcount by name