You need to use mvexpand to break out the multivalue Fruits field into one record per value, then rex to extract the count, then sum up whatever you are interested in.
If you only want the total count for Apples, then the code looks like this -
index=myindex host=myhost Fruits=*Apple*
| mvexpand Fruits
| search Fruits=*Apple*
| rex field=Fruits "^Apple = (?<FruitCount>[0-9]+)$"
| stats count as RecordCount, sum(FruitCount) as AppleCount
If you want a table of the total values for all fruits, then the code looks like this -
index=myindex host=myhost Fruits=*
| mvexpand Fruits
| rex field=Fruits "^(?<FruitName>[A-Za-z]+) = (?<FruitCount>[0-9]+)$"
| stats count as RecordCount, sum(FruitCount) as FruitCount by FruitName
| table FruitName RecourdCount FruitCount
In general, I'd expect to be adding the min/max date range of the records retrieved, and so on, but that's the basic method.
... View more