Splunk Search

count events in multivalue field

perlish
Communicator

Hi,
I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in the following picture, I want to get search result of (myfield>44) in one event.
alt text

0 Karma
1 Solution

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try this?

YOUR_SEARCH
| eval myfield=mvfilter(myfield>44) 
| eval n=mvcount(myfield)

My Sample search:

| makeresults 
| eval myfield="10,20,30,40" 
| makemv delim="," myfield 
| eval myfield=mvfilter(myfield>20) 
| eval n=mvcount(myfield)

Thanks

View solution in original post

cmerriman
Super Champion

try this:

|eval myfield_count=mvcount(mvfilter(myfield>44))

perlish
Communicator

Thanks! It works!

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI

Can you please try this?

YOUR_SEARCH
| eval myfield=mvfilter(myfield>44) 
| eval n=mvcount(myfield)

My Sample search:

| makeresults 
| eval myfield="10,20,30,40" 
| makemv delim="," myfield 
| eval myfield=mvfilter(myfield>20) 
| eval n=mvcount(myfield)

Thanks

perlish
Communicator

It works,thank you!
While I have another question, it seems that splunk parse the float to string sometimes, and because of this problem, the mvfilter function may become invalid. How can I solve it in this situation?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hih @perlish

Can you please share events or sample data which causes an error?

0 Karma

perlish
Communicator

I'm sorry that I don't have the sample data. When I tried to solve the question I asked ,I used nomv() method and found that the single value's type is string. Therefore, I asked the following question.

0 Karma

andrey2007
Contributor

try this command
| eval n=mvcount(myfield)

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...