What is the best way to count numbers of recipients in stanza?

[lucas4394]

I have a recipient field containing a list of recipient delimited by a comma.

What is the best way to calculate the total number of recipients from the recipient field?

Thanks.

For instance, if the recipient contains the following email, I want to create a calculated field, recipient_count, and the value is 2 from the sample.

john_doe@xyz.com, doe_john@abc.com

[aberkow · Accepted solution]

Something like this should work:

| makeresults count=1 
| eval emails = "john_doe@xyz.com, doe_john@abc.com" 
| eval emailMultiValue=split(emails, ", ")
| eval emailMultiValueCount=mvcount(emailMultiValue)

The last two lines are what you need - splitting the emails field into a multivalue field (either overwriting or creating a new multivalue field), and then counting the rows. There are some other ways to do this as well but I think it's the cleanest. Take a look at the functions in the eval command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#Usage to see all the things it can do!

Hope this helps.