Splunk Search

Hi Experts, I would like to count the multifield in the table where it has similar values

Ashwini_5
Explorer

I would like to count the multifield in the table where it has similar values. 

For Ex:  I need output like below for the COMPLETED_CERT_COUNT, It should only show the count of NOT_Expired training status. 

Ashwini_5_0-1642787628604.png

 

I have tried |eval COMPLETED_CERT_COUNT=mvcount(if(TRAINING_STATUS=="Not_Expired")) and

 

| stats mvcount(eval(TRAINING_STATUS="Not_Expired")) as certcount by name . But Nothing worked out. Kindly share your suggestion 

Labels (1)
Tags (1)
0 Karma

somesoni2
Revered Legend

Try something like this

|eval COMPLETED_CERT_COUNT=mvcount(mvfilter(match(TRAINING_STATUS,"Not_Expired"))) 
0 Karma

diogofgm
SplunkTrust
SplunkTrust

You could try to user mvexpand to expand the training_status and then do a stats count(eval(TRAINING_STATUS="Not_Expired")) as certcount by name

------------
Hope I was able to help you. If so, some karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...