I'm using transaction to build a list of actions taken on behalf of our users. Is it possible to run stats to count the number of times a particular action appears in a multi-valued field or do I need to run mvexpand first?
Thx.
Craig
Why not use the various multi-value field commands for this such as mvcount or mvfilter, etc?
http://docs.splunk.com/Documentation/Splunk/4.3.3/User/ParseFieldsWithMultipleValues
Why not use the various multi-value field commands for this such as mvcount or mvfilter, etc?
http://docs.splunk.com/Documentation/Splunk/4.3.3/User/ParseFieldsWithMultipleValues