count events in multivalue field

[perlish]

Hi,
I want to deal the multivalue field to get the counts whch is satisfied the conditions I set. For example, in the following picture, I want to get search result of (myfield>44) in one event.

[cmerriman]

try this:

|eval myfield_count=mvcount(mvfilter(myfield>44))

[perlish]

Thanks! It works!

[kamlesh_vaghela · Accepted solution]

HI

Can you please try this?

YOUR_SEARCH
| eval myfield=mvfilter(myfield>44) 
| eval n=mvcount(myfield)

My Sample search:

| makeresults 
| eval myfield="10,20,30,40" 
| makemv delim="," myfield 
| eval myfield=mvfilter(myfield>20) 
| eval n=mvcount(myfield)

Thanks

[perlish]

It works,thank you!
While I have another question, it seems that splunk parse the float to string sometimes, and because of this problem, the mvfilter function may become invalid. How can I solve it in this situation?

[kamlesh_vaghela]

Hih @perlish

Can you please share events or sample data which causes an error?

[perlish]

I'm sorry that I don't have the sample data. When I tried to solve the question I asked ,I used nomv() method and found that the single value's type is string. Therefore, I asked the following question.

[andrey2007]

try this command
| eval n=mvcount(myfield)