Hello everyone ! After a few hours of research i come ask your help. Here is my data : Username_column clientip_column username1 xxx.xxx.xxx.xxx username1 xxx.xxx.xxx.xxx username1 xxx.xxx.xxx.xxx username1 yyy.yyy.yyy.yyy username2 xxx.xxx.xxx.xxx username2 zzz.zzz.zzz.zzz username3 yyy.yyy.yyy.yyy username3 xxx.xxx.xxx.xxx   So, what i would like to do is to create another column called "countUsername" which contain the number of usernames by clientip without duplicates (of usernames). Here is my dream table (what i want) : Username_column clientip_column countUsername username1 xxx.xxx.xxx.xxx 3 username1 xxx.xxx.xxx.xxx 3 username1 xxx.xxx.xxx.xxx 3 username1 yyy.yyy.yyy.yyy 2 username2 xxx.xxx.xxx.xxx 3 username2 zzz.zzz.zzz.zzz 1 username3 yyy.yyy.yyy.yyy 2 username3 xxx.xxx.xxx.xxx 3   I tried various of things like : | eventstats values(count(Username_column)) as countUsername by clientip_column  creating a multivalue column and trying of mvdedup(). combine my Username_column and my clientip_column like so : | eval countUsername=Username_column. " " . clientip_column  and doing lots of things on that, if(mach)), regex, ... But everything that i tried didn't work. The best thing that i can get is : | eventstats count(Username_column) as countUsername by clientip_column  But with this line, my usernames are duplicated. (like the table bellow, i tried some things with this result but no results on my side) Username_column clientip_column countUsername username1 xxx.xxx.xxx.xxx 5 username1 xxx.xxx.xxx.xxx 5 username1 xxx.xxx.xxx.xxx 5 username1 yyy.yyy.yyy.yyy 2 username2 xxx.xxx.xxx.xxx 5 username2 zzz.zzz.zzz.zzz 1 username3 yyy.yyy.yyy.yyy 2 username3 xxx.xxx.xxx.xxx 5   Maybe you are wondering why i'm using eventstats instead of stats. The reason is that before this line, i have a large search with multiple stats commands, and if i don't use eventstats, all my others columns at the end of my large request won't show up. Kind regards, ... View more

Hello everyone ! I'm trying to split a single multivalue event into multiple multivalue events. Here is my base search : sourcetype="xxxx" | transaction clientip source id maxspan=5m startswith="yesorno=yes" endswith="event=connected" keepevicted=true mvlist=true,responsetime,status,yesorno,clientip,event,_time | sort _time | eval MergedColumns=responsetime . " " . yesorno | stats list(event) as event, list(MergedColumns) as MergedColumns, list(responsetime) as responsetime, by yesorno, clientip, id | where !(event=="connected") | table MergedColumns source clientip Unfortunately, i am obliged to use a transaction here and not the stats command. Here is my data : MergedColumns source clientip 10 yes 510 no 348 no 50886 no username1 xxx.xxx.xxx.xxx 10 yes 513 no 1239 no 9 yes 160 no 340 no 21421 no 509 no 685 no 13799 no 149 no username2 xxx.xxx.xxx.xxx I would like to split my event on the "xxx yes" like so : MergedColumns source clientip 10 yes 510 no 348 no 50886 no username1 xxx.xxx.xxx.xxx 10 yes 513 no 1239 no username2 xxx.xxx.xxx.xxx 9 yes 160 no 340 no 21421 no 509 no 685 no 13799 no 149 no username2 xxx.xxx.xxx.xxx Moreover, here, i have only two "xxx yes" in the same multivalue event, but i can possibly have more than that (like 3 or 4). I tried lots of things but none seems to work... (here is the regex to extract "xxx yes" => "^\S{1,} yes$") In fact, adding this : | mvexpand MergedColumns | regex MergedColumns="^\S{1,} success" | table MergedColumns source clientip This above seems to split my values correctly, however, it removes all the remaining "xxx no" values. Does anyone have a solution ? Kind regards, ... View more