How to search the count of field value occurrences, not event count, of multivalue fields in multiline events?

[masonmorales]

I have multiline events that contain anywhere from 1 to 30 status codes per event. For example:

status = success
status = success
status = failed
status = success

By default, I get a single field called "status" that contains a count of how many times "success" occurred and how many times "failed" occurred.

I would like to have two separate numerical fields, one called success_count and the other called failed_count that contain a count of how many times each value of the "status" field occurred per event (i.e. success_count=3, failed_count=1 in this example).

I have tried:

| stats count(eval(status="success")) as success_count, count(eval(status="failed")) as failed_count

However, the resulting counts appear to be the number of events that contain success_count and the number of events that contain failed_count, rather than a total count of all the field value occurrences for status=failed and status=success within each event.

Any help would be greatly appreciated!

[ppablo]

Hi @masonmorales

Just following up with this question, but did @ramdaspr's answer below help solve your question? If yes, please resolve this post by clicking "Accept" directly below the answer. If you found another solution that did work, please share. Thanks!

[ramdaspr · Accepted solution]

Assuming you have a mutivalue field called status the below (untested) code might work.

 .. | eval foo=mvfilter(match(status,"success")) | eval bar=mvfilter(match(status,"failed")) | streamstats window=1 current=t count(foo) as success_count,count(bar) as failed_count | table status,success_count,failed_count