Splunk Search

How do I find then number of elements in a comma delimited list?

mklunder
Explorer

Given the following log entry how would a find the number of host entries and assign it to a field?

Thanks!

FINEST|1137/0|Service KOALA-MANGOES|13-12-14 00:13:35|INFO: Available nodes: [host :htti://10.0.46.107:5555 time out : 30000, host :htti://10.0.46.103:5555 time out : 30000, host :htti://10.0.46.106:5555 time out : 30000, host :htti://10.0.49.52:5555 time out : 30000, host :htti://10.0.49.176:5555 time out : 30000, host :htti://10.0.49.53:5555 time out : 30000, host :htti://10.0.39.21:5555 time out : 30000, host :htti://10.0.39.17:5555 time out : 30000, host :htti://10.0.39.19:5555 time out : 30000, host :htti://10.0.49.51:5555 time out : 30000, host :htti://10.0.39.20:5555 time out : 30000, host :htti://10.0.33.62:5555 time out : 30000, host :htti://10.0.39.18:5555 time out : 30000, host :htti://10.0.46.105:5555 time out : 30000, host :htti://10.0.50.102:5555 time out : 30000, host :htti://10.0.46.104:5555 time out : 30000, host :htti://10.0.49.54:5555 time out : 30000]
0 Karma
1 Solution

kristian_kolb
Ultra Champion

I would suggest that you extract the host values as a multi-valued field.

Then you can find out the number of hosts by using the mvcount() function for eval.

... | eval XXX = mvcount(servers)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

View solution in original post

kristian_kolb
Ultra Champion

I would suggest that you extract the host values as a multi-valued field.

Then you can find out the number of hosts by using the mvcount() function for eval.

... | eval XXX = mvcount(servers)

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

/K

mklunder
Explorer

Thanks. That did the trick. I am now trying to do it in a calculated field such as

mvcount( SPLIT(nodes, ",") ) 

but am getting an error on the web ui. This is tracked in another question. Thanks again.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...