Hi everyone. I would like to ask what is the function to get the number of records in a field?
So here's my scenario.
I use the search to get results below using transaction by username
|search *** transaction by username | table server_name, username, ipaddress
using the above results, i want to count the number of records in the ipaddress field and display the number of records but remove the field where ipaddress is less than 2 records.
I want this kind of output:
Thanks I hope someone can help me..
In your case you can use mvcount() function for conting occurrences of multi-valued field.
| eval no_of_multiple_con=mvcount(ipaddress)
However, I would try to move away from transaction to stats command
<YourBaseSearch> | stats values(server_name) as server_name values(ipaddress) as ipaddress count(ipaddress) as no_of_multiple_con dc(ipaddress) as disctinctIPCount by username
PS: Since you have not included server_name as your transaction ID, I would expect multiple Server Names to be returned as well. Hence I have used values() function.
Also I have included dc() function for distinct count of IP Addresses in case the same gets repeated.
@wiggler... Glad it worked. Hope you are using stats as it would perform better than transaction as you might have seen 🙂