Hi all,
I have a search that looks something like this:
foo | extract pairdelim="|;]}" kvdelim="=:" mv_add=true | eval legs=mvcount(Leg)+1 | stats count by id, legs
The multi value field "Leg" has one of the 3 possible values "", "2", "2 3". I expected mvcount to work like count and when there are no values to display 0. Is there a way to display what I would I expect? Explicitly the mapping I wanted to do was from the multi value field "Leg": No Value -> 1, "2" -> 2, "2 3" -> 3
Any idea?
The documentation says mvcount returns the number of values of the field if it's multivalued, 1 if it's singlevalued, and NULL otherwise. Given the mapping you describe, I think you want to do something like this:
... | eval legs=if(isnull(Leg),1,mvcount(Leg)+1)
You're welcome, @DamianS. Would you mind clicking the checkmark next to my answer to accept it? Thanks.
Perfect! Thanks for your help!