How to Group field values into similar field values?

[michaeler]

I am trying to get network outage totals by domain. I have four domains: A, B, C, D. The problem is that sometimes there are outages that effect 2-3 domains that are reported as a different event and not by domain. 

| chart count(event_id) as Count by Domain

A                                           4
B                                           7
C                                           2
D                                           5
A, B                                      2
A, D                                      4
C, B                                      3
A, D, B                                 6

I want to display outages that effect each domain. So anything that includes A (A; A,B; A,D; A,D,B) will be added and the count for A will be 16. Same for the other domains.

The end result should be:
A                            16
B                            18
C                            5
D                            15

I've tried eval domain=if(domain=A OR domain="A, B" OR domain="A, D" OR domain="A, D, B", "A", domain) ....... but that only works for the first one. The combined domains aren't included in the totals for the subsequent if statements.

[isoutamo · Accepted solution]

Hi

you can do it like this

| makeresults
| eval _raw = "Domain Value
A     4
B     7
C     2
D     5
A,B   2
A,D   4
C,B   3
A,D,B 6"
| multikv fields Domain Value
| fields Domain Value
```Above generate test data. You should replace it by your base search```
| eval Domain = split(Domain, ",")
| mvexpand Domain
| stats sum(Value) as Value by Domain

r. Ismo 

[ITWhisperer]

@isoutamo 's solution works - one tweak I would make is to remove the mvexpand as it is unnecessary as stats will work over the elements of the multivalue field mentioned in the by clause.

[isoutamo]

Thanx good to remember!