Splunk Search

How to count the distinct list values

Contributor

My results look like these:

V1    V2 
A    X Y Z Z X Y Y 
B   X X X Y Z Z X Y Y 

V2 IS A LIST.

I want to add V3 column along where V3 will show THE count OF DISTINCT VALUES OF V2.
Is this feasible?

V2 too could have distinct x y zs.

0 Karma
1 Solution

Builder

Hi @reverse ,

You could try the following search:

... [ your search stuff here ] ...
| eval V3 = mvcount(mvdedup(split(V2, " ")))

To address the individual counts by each value of V2:

... [ your search stuff here ] ...
| eval key = V1 . "|" . mvjoin(V2, "|")
| mvexpand V2
| eventstats count as V2_Count by V2 key
| eval V2P = V2 . " Count = " . V2_Count
| stats values(V2P) as V3 list(V2) as V2 by key
| eval V1 = mvindex(split(key, "|"), 0)
| table V1 V2 V3

View solution in original post

0 Karma

Builder

Hi @reverse ,

You could try the following search:

... [ your search stuff here ] ...
| eval V3 = mvcount(mvdedup(split(V2, " ")))

To address the individual counts by each value of V2:

... [ your search stuff here ] ...
| eval key = V1 . "|" . mvjoin(V2, "|")
| mvexpand V2
| eventstats count as V2_Count by V2 key
| eval V2P = V2 . " Count = " . V2_Count
| stats values(V2P) as V3 list(V2) as V2 by key
| eval V1 = mvindex(split(key, "|"), 0)
| table V1 V2 V3

View solution in original post

0 Karma

Contributor

@jnudell_2- you rock!! amazing!

0 Karma

Contributor

thanks .. but didn't work ... v2 is a list .. each item in a separate line.. so there was no need for split .. i removed it .. still didn't work ..

0 Karma

Contributor

V3 gave me count of total distinct values .. i wanted count of each Xs.. Ys ans Zs... hope i am able to remove the confusion now..

0 Karma

Builder

I have updated the answer, given your clarification.

0 Karma

Contributor

@Vijeta please guide.

0 Karma

Contributor

| stats count(action) as V1, list(NAMES) as V2 by SOMETHING

ABOVE IS RESULT OF THIS

0 Karma