How to count number of values in multi-valued field?

[LAcioffi]

Hello!

In any event i have two fields, something like:

User - Bob
Hobbies - Singing, Dancing, Eating

The "Hobbies" field is a multivalued field, and i want the output to be something like this:

User - Bob
Hobbies_Number - 3
Hobbies - Singing, Dancing, Eating

TL;DR - Is there an easy way to count how many values are in a multivalued field and show it?

Thanks in advance!

[vijay_k]

@rjthibod  for mvcount should we pass token value ? should it be with $$

[rjthibod]

It probably depends on what the token represents.

In the original answer, the example was asking for `mvcount` against a known field name.

So, if the token you are passing is a field name and not a value of a field, then it would work.

You'd have to give more specific data about your requests to get a more confident answer, but even then, I haven't been an active Splunk dev for quite some time. So everything I say might be off.

[vijay_k]

<input type="multiselect" token="product_token" searchWhenChanged="true">
<label>Product types</label>
<choice value="*">All</choice>
<default>*</default>
<prefix>(</prefix>
<suffix>)</suffix>
<initialValue>*</initialValue>
<valuePrefix>DB_Product="*</valuePrefix>
<valueSuffix>*"</valueSuffix>
<delimiter> OR </delimiter>
<fieldForLabel>DB_Product</fieldForLabel>
<fieldForValue>DB_Product</fieldForValue>
<search base="base_search_Products">
<query>|dedup DB_Product | table DB_Product</query>
</search>
</input>

This is my input multi select , thorugh which user select product Types example - All /A,B,C,D etc

I need to count, How many Product types are selcted by user . This info i need for further processing.

[rjthibod]

99% confident nothing like `mvcount` is going to give you that directly.

Likely have to use custom JS, or write a hidden search that will determine that and runs every time the selection for your input has changed. 

I'd suggest posting this as its own question. That will get more attention than putting it in the thread of answered question.

[vijay_k]

thanks i will create new thread

[rjthibod · Accepted solution]

use the mvcount eval function

... | eval Hobbies_Number = mvcount(Hobbies)

[vince2010091]

not working anymore (splunk 9.0.2)

do you have the same issue ?