mvcount by value

[rafadvega]

Hi,

I would like to count the values of a multivalue field by value. For example:

| makeresults 
| eval values_type=split( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2,",",") 
| eval values_count=mvcount(values_type)
| eval value1=mvfilter(match(values_type,"value1"))
| eval value1_count=mvcount(value1)
| eval value2_count=values_count - value1_count
| table values_type message_count values_count value1_count value2_count

rafadvega_0-1637256185618.png

Is there another way to do this? For example, if I don't know the possible values, this way doesn't work.

Thanks in advance

[ITWhisperer]

| makeresults 
| eval values_type=split( "value1,value2,value1,value2,value1,value2,value1,value2,value2,value2,value2",",") 
| stats count by values_type