is it possible to get the sum of a multivalued field within a transaction without a unique id??

[vijai_thomas]

Hi,
I want to count the number or errors within two keywords say starttran and endtran.
My log data would be like

• starttran
• tran Id:1000
• error*
• abc done
• error*
• endtran

My query : sourcetype="abc" | eval haserror=if(searchmatch("error"),1,0) | transaction startswith=starttran endswith=endtran mvlist=haserror | table haserror TRANID

O/P

• haserror / TRANID
• 0
• 0 / 1000
• 1
• 0
• 1
• 0

But i want it like

• haserror / TRANID
• 2 / 1000

I tried using sum(haserror) by TRANID but din't. Kindly help . Also here can't TRANID be used as unique ID ?

Thanks a lot

[lguinn2 · Accepted solution]

sourcetype="abc" 
| eval haserror=if(searchmatch("error"),1,0) 
| transaction startswith=starttran endswith=endtran mvlist=haserror 
| eval ErrorCount = mvcount(mvfilter(haserror==1))
| table ErrorCount TRANID

should work

[vijai_thomas]

This worked .. Thanks a lot 🙂