Need to get the count of number of times a field is used in a request

[ndayanat]

Need to get the count of number of times a field is used in a request

    Ex log:
    (This is a XML log, giving details from the middle and not the entire log)

Event 1: 
<students>
<student name="Raja" age="13" class="6" />
<student name="Nar" age="15" class'"8" />
<student name="Mag" age="16" class="7" />
</students>

Event 2:
<students>
<student name="Rex" age="13" class="6" />
<student name="Nanny" age="15" class'"8" />
</students>

I need to check how many times the field "Name" is used. As you can see the count varies for each event. How do I get that count?

[sundareshr · Accepted solution]

Try this

| rex max_match=0 "(?<name>name)" | eval occurrences=mvcount(name) | table name occurrences

[ndayanat]

Sundareshr, Thank you for that. Can you please explain the rex and mvcount used above.

I also have one more doubt and will be more pleased if you clear that as well.
Take the Event1 from the above example. If I am filtering that alone and viewing it in splunk. Then the interesting fields has a field "name". My understanding was that it should display all the name's mentioned in the event. But it only displays the first name. for the above example it only displays Raja.

Is my understanding wrong?

[sundareshr]

rex is SPL's regular expression command. I used that to extract all occurrences of the word "name" in an event. I used max_match switch to create a multi-value field with as many matches as rex finds

https://regex101.com/r/sX8wD1/1

mvcount is for counting values within multi-value fields. Here's more on that

http://docs.splunk.com/Documentation/Splunk/6.4.2/Search/Parsemultivaluefields#Evaluate_multivalue_f...

By default, field extraction will extract one occurrence. To get more than one, you either use rex with max_match or add MV_ADD in your transforms extraction. More on that here

https://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Transformsconf

[ndayanat]

This was really helpful. But i have one more doubt here, we have used mvcount to get the count of that field, in case if I want to display the values for that field, what function do we use?

Ex: In event 1, there is a field called name, and if I check the values it only displays the first name of each event. ie Raja(from event 1) and Rex(from event 2). However, i want to display all the names in this field name.