using 'values' in stats shows values merged

[beriwalnishant]

Hello Experts,

I was wondering if you can help me figure out how do I show the merged values in a field as 'unmerged' when use 'values' in stats command

beriwalnishant_0-1700457913149.png

(DETAILS_SVC_ERROR) and (FARE/PRCNG/AVL-MULT. RSNS) are different values .... coming as merged as an example, its merging all values in one when used "Values" OR "List" how to unmerge same

If I use 'mvexpand' it then expands to single count even if the values are same

Thanks in advance

Nishant

[PickleRick]

Well, this is how it's supposed to work. list() or values() gives you a multivalued field with a list of values.

If you need something else, you need to do something else.

[beriwalnishant]

But then I dont get the individual Totals if I do that along with the message.

[ITWhisperer]

Perhaps it would be better for you to show what it is that you do want?

[ITWhisperer]

You are correct, mvexpand of a values() or list() field will duplicate the event. If you want to count by ErrorCode separately, include ErrorCode in your by clause of the stats command.