Splunk Search

How to use mvcount or mvexpand to separate multiple values from two different fields?

jwalzerpitt
Influencer

I have an index that contains two fields, sig_names and sig_ids, that can contain multiple values for each. I'd like to separate out the values to get a count for each.

Right now I do a generic stats count search of:

    index=foo
    | stats count by sig_names,sig_ids 
    | sort -count

and the results are as follows:

sig_names     sig_ids   count
foo1, foo2     1,2          18
foo6, foo8     6,8          16
foo4, foo3     4,3          4

Is it possible to separate the values out to get a count for each as such:

sig_names     sig_ids   count
foo1               1             18
foo2               2             18
foo6               6             16
foo8               8              8
foo4               4              4
foo3               3              4

Thx

1 Solution

somesoni2
Revered Legend

I doesn't look like the fields sig_names are multivalued fields already. Try something like this

index=foo
| makemv sig_names delim="," | makemv sig_ids delim="," 
| eval temp=mvzip(sig_names, sig_ids,"###")
| stats count by temp
| rex field=temp "(?<sig_names>.+)###(?<sig_ids>.+)
| table sig_names sig_ids count

View solution in original post

0 Karma

kmaron
Motivator

I had somewhat of a similar question over here: https://answers.splunk.com/answers/623015/question-involving-breaking-out-multiple-multivalu.html

Maybe that answer can help you split out the fields before you count them.

0 Karma

jwalzerpitt
Influencer

Thx for the link as that info and answer is very helpful as well

0 Karma

somesoni2
Revered Legend

I doesn't look like the fields sig_names are multivalued fields already. Try something like this

index=foo
| makemv sig_names delim="," | makemv sig_ids delim="," 
| eval temp=mvzip(sig_names, sig_ids,"###")
| stats count by temp
| rex field=temp "(?<sig_names>.+)###(?<sig_ids>.+)
| table sig_names sig_ids count
0 Karma

jwalzerpitt
Influencer

Thx - worked perfectly

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...