Separate values from multi valued field

[Dhruvi]

I have to write query for extracting out the values from multi valued field

example field: 

Region=America, Africa

Region=Asia

Region=America, Asia

i want table like this:

Region            Count

America             2

Asia                     2

Africa                 1

I have used split cmmnd:

eval temp=split(Region,“,”) 

Now what is happening is it is only giving me count of Asia =1
 

Need little help:)

[to4kawa]

| makeresults
| eval _raw="Region=America, Africa
Region=Asia
Region=America, Asia"
| multikv noheader=t
| rex max_match=0 "(?<Region>A\w+)"
| table Region
| rename COMMENT as "this is your sample"
| stats count by Region

try stats by

[Dhruvi]

okay it is working well 

[gcusello]

Hi @Dhruvi ,

you have ro separate values in distinct events and then use stats, something like this:

| makeresults | eval Region="America, Africa"
| append [ | makeresults | eval Region="America, Africa" ]
| append [ | makeresults | eval Region="America" ]
| append [ | makeresults | eval Region="Asia" ]
| makemv delim="," Region
| mvexpand Region
| stats count BY Region

Use the last three rows.

Ciao.

Giuseppe

[Dhruvi]

Thanks 🙂 it works as expected