how to get the number of records of a field and sum up and show records more than one

[wiggler]

Hi everyone. I would like to ask what is the function to get the number of records in a field?

So here's my scenario.

I use the search to get results below using transaction by username

|search *** transaction by username | table server_name, username, ipaddress

using the above results, i want to count the number of records in the ipaddress field and display the number of records but remove the field where ipaddress is less than 2 records.

I want this kind of output:

Thanks I hope someone can help me..

[niketn · Accepted solution]

In your case you can use mvcount() function for conting occurrences of multi-valued field.

| eval no_of_multiple_con=mvcount(ipaddress)

However, I would try to move away from transaction to stats command

 <YourBaseSearch> | stats values(server_name) as server_name values(ipaddress) as ipaddress count(ipaddress) as no_of_multiple_con dc(ipaddress) as disctinctIPCount by username

PS: Since you have not included server_name as your transaction ID, I would expect multiple Server Names to be returned as well. Hence I have used values() function.
Also I have included dc() function for distinct count of IP Addresses in case the same gets repeated.

[wiggler]

@niketnilay.. thanks a lot.. it works 🙂

[niketn]

@wiggler... Glad it worked. Hope you are using stats as it would perform better than transaction as you might have seen 🙂

[wiggler]

@niketnilay yeah much better than transaction. thank you very much