How to count number of occurrences of string in single event and group as per count ?

[splunkDevendra]

I want to find out How many times string appeared in ONE SINGLE EVENT.
and group all the events and find table like :

Attempts        : Count :
1                            100
2                            342
3                            201
4                            04
5                            00

how to write query for this ?

[bowesmana]

Here is an example of how you can count the number of attempts.aggrStatus elements in each object

| makeresults
| eval _raw="\"objectA\":{\"aggrStatus\":\"SUCCESS\",\"attempts\":[{\"aggrStatus\":\"FAILURE\",\"responses\":[{\"requestTime\":1626329472707,\"responseTime\":1626329474713,\"status\":\"FAILURE\"}]},{\"aggrStatus\":\"SUCCESS\",\"responses\":[{\"requestTime\":1626330378365,\"responseTime\":1626330378622,\"status\":\"SUCCESS\"}]}]}"
| rex field=_raw "objectA\":(?<json>.*)"
| spath input=json
| eval attempts=mvcount('attempts{}.aggrStatus')

assuming you have a parsed JSON object to play with - in the above I have parsed your data into JSON so I cna see the attempts.aggrStatus elements.

Then you just need to add the following to your search to get the counts

| stats count by attempts
| sort attempts

[ITWhisperer · Accepted solution]

| rex max_match=0 "(?<status>aggrStatus)"
| eval attempts=mvcount(status)
| stats count by attempts

[splunkDevendra]

How can we show Percentage (%) of each attempt in table itself in stead of drawing different chart from same table ?

[splunkDevendra]

found following working 

| stats count as Count by attempts
| eventstats sum(Count) as Total
| eval perc=round((Count/Total)*100,2)
| fields - Total
| sort 0 - Count
| head 10

[splunkDevendra]

How to minus one attempt from final table as it counts 1 extra attempt in every event

[ITWhisperer]

| eval attempts=mvcount(status)-1