Splunk Search

Count occurences of same ticket number in a multivalue field

timyong80
Explorer

Hello guys,

I am trying to count the number of times the same ticket number appears in a multi-value field. The ticket number represents a new case opened by IT Support when a problem occurs. Example:

Ticket_Number Occurences

IT90987 1
IT89332 2
IT43015 1
IT89332 1
IT11122 1

Is there a way to do that?

Your help is much appreciated. Thank you.

Tags (1)
0 Karma

cmerriman
Super Champion

try something like this:

|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number

if you have other fields in your search you need to keep, maybe tack that into an appendpipe.

...|appendpipe [|mvexpand Ticket_Number|stats count as Occurences by Ticket_Number anyOtherImportantFields|eval Ticket_NumberOccurrences=Ticket_Number+"-"+Occurences]|stats values(Ticket_NumberOccurrences) as Ticket_NumberOccurrences list/values(anyOtherFields) as anyOtherFields by anyOtherImportantFields
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...