How to get count of a field per event?

[jameshgibson]

I am using a transaction to get the start/end/duration of jobs. This gives me back about 200 events. Something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | table start, end, duration

I would like to extract the number of "tasks" that are done in in this job I use the "rex" command to get a the field:

rex field=_raw ".*(?<task>Task started).*" | stats count(task)

unfortunatly the stats command groups all the events which I dont want. I really want something like:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | rex field=_raw ".*(?<task>Task started).*" | eval start = _time | eval end = _time + duration | table start, end, duration, count(task)

[Ayn · Accepted solution]

Use eval's mvcount:

sourcetype=x | transaction startswith="Job start" endswith="Job complete" | eval start = _time | eval end = _time + duration | eval taskcount = mvcount(task) | table start, end, duration, taskcount

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/CommonEvalFunctions

[jameshgibson]

I just want a field count within each event. I dont care if the tasks are repeated or not.

[kristian_kolb]

So you mean it's a distinct count? Then make a different field extraction through rex;

... | rex "(?.{20}).*Task started" | ...

In this case, grab the first 20 characters of your events as a unique task id (assuming there is a timestamp there - YMMV). This should do fine, if you don't really need to look a the actual values.

/kristian

[jameshgibson]

doesn't do what I need, it just returns 1 or 0 depending if there are any tasks in the transaction