How do I find then number of elements in a comma delimited list?

[mklunder]

Given the following log entry how would a find the number of host entries and assign it to a field?

Thanks!

FINEST|1137/0|Service KOALA-MANGOES|13-12-14 00:13:35|INFO: Available nodes: [host :htti://10.0.46.107:5555 time out : 30000, host :htti://10.0.46.103:5555 time out : 30000, host :htti://10.0.46.106:5555 time out : 30000, host :htti://10.0.49.52:5555 time out : 30000, host :htti://10.0.49.176:5555 time out : 30000, host :htti://10.0.49.53:5555 time out : 30000, host :htti://10.0.39.21:5555 time out : 30000, host :htti://10.0.39.17:5555 time out : 30000, host :htti://10.0.39.19:5555 time out : 30000, host :htti://10.0.49.51:5555 time out : 30000, host :htti://10.0.39.20:5555 time out : 30000, host :htti://10.0.33.62:5555 time out : 30000, host :htti://10.0.39.18:5555 time out : 30000, host :htti://10.0.46.105:5555 time out : 30000, host :htti://10.0.50.102:5555 time out : 30000, host :htti://10.0.46.104:5555 time out : 30000, host :htti://10.0.49.54:5555 time out : 30000]

[kristian_kolb · Accepted solution]

I would suggest that you extract the host values as a multi-valued field.

Then you can find out the number of hosts by using the mvcount() function for eval.

... | eval XXX = mvcount(servers)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

[mklunder]

Thanks. That did the trick. I am now trying to do it in a calculated field such as

mvcount( SPLIT(nodes, ",") ) 

but am getting an error on the web ui. This is tracked in another question. Thanks again.