i have raw data like
cat | dog | ele
cat | dog
dog | ele
this field name is catego
result should be counting like this => cat = 2, dog =3, ele =2
sourcetype=movie | eval n= split(genre,"|") |table count(n) by n < = this is not splitting the string
OK, some issues here.
For one, the field name is catego, but in your search you use "genre"?
And then, table
is no statistical command. It only shows the fields you supply as arguments. count(n) is no field, neither is "by".
Maybe you want something like this:
sourcetype=movie | eval n=split(catego,"|") | stats count by n
OK, some issues here.
For one, the field name is catego, but in your search you use "genre"?
And then, table
is no statistical command. It only shows the fields you supply as arguments. count(n) is no field, neither is "by".
Maybe you want something like this:
sourcetype=movie | eval n=split(catego,"|") | stats count by n
oh ... my mistake!
the table name is genre 🙂
thanks!