As @gcusello says, stats will count the occurrences easily, but only if they are in a multi-value field, so it depends on how your data is actually represented. The following runanywhere example uses...
See more...
As @gcusello says, stats will count the occurrences easily, but only if they are in a multi-value field, so it depends on how your data is actually represented. The following runanywhere example uses the lines you gave as an example as the starting point, but your actually data may be different to this. | makeresults
| eval _raw="Satisfied Conditions: XYZ, ABC, 123, abc
Satisfied Conditions: XYZ, bcd, 123, abc
Satisfied Conditions: bcd, ABC, 123, abc
Satisfied Conditions: XYZ, ABC, 456, abc"
| multikv noheader=t
| rename _raw as Condition
| table Condition
``` The lines above set up some dummy data - possibly similar to your post? ```
``` First split out the conditions ```
| eval Condition=mvindex(split(Condition,": "),1)
``` Second split the conditions into a multi-value field ```
| eval Condition=split(Condition,", ")
``` Now stats can count the occurrences of the conditions ```
| stats count by Condition