Answer by warren for Get statistical distribution of multivalue entry in Splunk

First, you need to break the multivalue field into separate entries

This is one way to do it:

| makemv delim="," product_category
| mvexpand product_category
| stats values(product_category) as vpc dc(product_category) as dpc count by user_id

from User warren – Stack Overflow https://stackoverflow.com/questions/76386274/get-statistical-distribution-of-multivalue-entry-in-splunk/76400300#76400300
via IFTTT