Hi guys,
I have the following exemple:
Searching the "s" in Field B delimited by "," , my expected result is the following
FIELD A | FIELD B | COUNT
x | s,a,b,c | 1
y | s,x,x,xs | 2
z | s,a,s,s,s | 4
Thanks for the help
Use rex to extract character 's' and count it.
| rex field=_raw max_match=0 "(?[s]+)" | eval slen=mvcount(smatch)
Sample query:
| makeresults | eval "FIELD A"="x", "FIELD B"="s,a,b,c" | append [| makeresults | eval "FIELD A"="y", "FIELD B"="s,x,x,xs"] | append [| makeresults | eval "FIELD A"="z", "FIELD B"="s,a,s,s,s"] | rex field="FIELD B" max_match=0 "(?<smatch>[s]+)" | eval count=mvcount(smatch) | table "FIELD A", "FIELD B", count
thanks , that was clear .
regards
@habrhi - assuming A and B are your field names
your query |eval newB=B| makemv delim="," newB| mvexpand newB| stats count(eval(LIKE(newB,"%s%"))) as c by A B
Use rex to extract character 's' and count it.
| rex field=_raw max_match=0 "(?[s]+)" | eval slen=mvcount(smatch)
Sample query:
| makeresults | eval "FIELD A"="x", "FIELD B"="s,a,b,c" | append [| makeresults | eval "FIELD A"="y", "FIELD B"="s,x,x,xs"] | append [| makeresults | eval "FIELD A"="z", "FIELD B"="s,a,s,s,s"] | rex field="FIELD B" max_match=0 "(?<smatch>[s]+)" | eval count=mvcount(smatch) | table "FIELD A", "FIELD B", count