Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- What is the best way to count numbers of recipient...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have a recipient field containing a list of recipient delimited by a comma.
What is the best way to calculate the total number of recipients from the recipient field?
Thanks.
For instance, if the recipient contains the following email, I want to create a calculated field, recipient_count, and the value is 2 from the sample.
john_doe@xyz.com, doe_john@abc.com
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like this should work:
| makeresults count=1
| eval emails = "john_doe@xyz.com, doe_john@abc.com"
| eval emailMultiValue=split(emails, ", ")
| eval emailMultiValueCount=mvcount(emailMultiValue)
The last two lines are what you need - splitting the emails field into a multivalue field (either overwriting or creating a new multivalue field), and then counting the rows. There are some other ways to do this as well but I think it's the cleanest. Take a look at the functions in the eval command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#Usage to see all the things it can do!
Hope this helps.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Something like this should work:
| makeresults count=1
| eval emails = "john_doe@xyz.com, doe_john@abc.com"
| eval emailMultiValue=split(emails, ", ")
| eval emailMultiValueCount=mvcount(emailMultiValue)
The last two lines are what you need - splitting the emails field into a multivalue field (either overwriting or creating a new multivalue field), and then counting the rows. There are some other ways to do this as well but I think it's the cleanest. Take a look at the functions in the eval command https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Eval#Usage to see all the things it can do!
Hope this helps.
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
