If I have queries with Lists/Arrays containing events :
line.Data = [eventOne, eventThree]; line.Data = [eventOne, eventTwo];
How can I create a table that shows the count of the different events:
eventOne: 2
eventTwo: 1
eventThree: 1
Here is a runanywhere example of how you might approach this
| makeresults
| fields - _time
| eval line.Data = split("[eventOne, eventThree];[eventOne, eventTwo]",";")
| mvexpand line.Data
``` the lines above create sample events, one event per line.Data ```
| eval event=split(trim('line.Data',"[]"),", ")
| stats count by event
Try this.
<your base search>
| mvexpand line.Data
| stats count by line.Data