Hi Have an event like this shown below
Today's Greeting Message=Hello|myname|name|is|Alice|myName|is|bob Good bye for today
The have a field name Message and its value is Hello|myname|name|is|Alice|myName|is|bob
How will I get the count of the words based on separator of a specific field value. And adding some new number to the count received and assign it to a new field value.
example for above log i will get 8 as count based on | separator(separator count+1). Now i will add 2 to the count(8+2) and the value to be updated to a new splunk field.
This will help in calculating if any event that is crossing the threshold of that value then i can trigger an alert.
Some one please help me in getting this.
You can count the words by using mvcount on the split field as below
| makeresults
| eval Message="Hello|myname|name|is|Alice|myName|is|bob"
| eval wordCount=mvcount(split(Message,"|"))
then you can do whatever you like to the wordCount, so in your example just add the two as part of the eval statement
| makeresults
| eval Message="Hello|myname|name|is|Alice|myName|is|bob"
| eval wordCount=mvcount(split(Message,"|"))+2
Hope this helps