Splunk Search
Highlighted

Separate values from multi valued field

Engager

I have to write query for extracting out the values from multi valued field

example field: 

Region=America, Africa

Region=Asia

Region=America, Asia

i want table like this:

Region            Count

America             2

Asia                     2

Africa                 1

I have used split cmmnd:

eval temp=split(Region,“,”) 

Now what is happening is it is only giving me count of Asia =1
 

Need little help:)

Labels (2)
0 Karma
Highlighted

Re: Separate values from multi valued field

Legend

Hi @Dhruvi ,

you have ro separate values in distinct events and then use stats, something like this:

| makeresults | eval Region="America, Africa"
| append [ | makeresults | eval Region="America, Africa" ]
| append [ | makeresults | eval Region="America" ]
| append [ | makeresults | eval Region="Asia" ]
| makemv delim="," Region
| mvexpand Region
| stats count BY Region

Use the last three rows.

Ciao.

Giuseppe

 

Highlighted

Re: Separate values from multi valued field

Engager

Thanks 🙂 it works as expected 

0 Karma
Highlighted

Re: Separate values from multi valued field

Ultra Champion
| makeresults
| eval _raw="Region=America, Africa
Region=Asia
Region=America, Asia"
| multikv noheader=t
| rex max_match=0 "(?<Region>A\w+)"
| table Region
| rename COMMENT as "this is your sample"
| stats count by Region

try stats by

Highlighted

Re: Separate values from multi valued field

Engager

okay it is working well 

 

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.