I have to write query for extracting out the values from multi valued field
example field:
Region=America, Africa
Region=Asia
Region=America, Asia
i want table like this:
Region Count
America 2
Asia 2
Africa 1
I have used split cmmnd:
eval temp=split(Region,“,”)
Now what is happening is it is only giving me count of Asia =1
Need little help:)
| makeresults
| eval _raw="Region=America, Africa
Region=Asia
Region=America, Asia"
| multikv noheader=t
| rex max_match=0 "(?<Region>A\w+)"
| table Region
| rename COMMENT as "this is your sample"
| stats count by Region
try stats by
okay it is working well
Hi @Dhruvi ,
you have ro separate values in distinct events and then use stats, something like this:
| makeresults | eval Region="America, Africa"
| append [ | makeresults | eval Region="America, Africa" ]
| append [ | makeresults | eval Region="America" ]
| append [ | makeresults | eval Region="Asia" ]
| makemv delim="," Region
| mvexpand Region
| stats count BY Region
Use the last three rows.
Ciao.
Giuseppe
Thanks 🙂 it works as expected