Splunk Search

How to get counts of events matching only particular value pattern from multi valued field

arrangineni
Path Finder

I am trying to get counts of events that match only a particular field value pattern from a multi-valued field.

Multi valued field values like:
name=abc;name=12345;name=246
name=12344
name=246;name=abc
name=12378

Need counts of events which only contains field values containing name=123* and ignore the once which are combination of others?

I did try the below but it includes all events containing name=123*
| makemv delim=";" multivalued-field
| rex field=multivalued-field "name=(?P[^,]+),"
| search whatineed="123*"

0 Karma

to4kawa
Ultra Champion
| makeresults 
| eval _raw="raw
name=abc;name=12345;name=246
name=12344
name=246;name=abc
name=12378
name=12378;name=12379" 
| multikv forceheader=1 
| rex max_match=0 "name=(?<name>[^;]+)" 
| rename COMMENT as "this is sample. form here, the logic" 
| table name 
| rename COMMENT as "please check this result" 
| eval names=mvmap(name,if(match(name,"^123"),1,0)) 
| streamstats window=1 sum(names) as sums 
| where mvcount(names) = sums 
| stats count
0 Karma

arrangineni
Path Finder

@to4kawa thanks for assisting, but using the above approach I am also getting the count for " name=abc;name=12345;name=246" which I don't need.

I am looking for counts which ONLY included values 123* and ignore other combinations. But combination of 123* and 123* is valid.

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...