# Count occurrences

## Description

This operation counts the number of times a provided string (character, word, or phrase) appears in the given input data.

***

## Data types

These are the input/output expected data types for this operation:

### Input data

![](https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FZmr35bwgundYfOW63E3q%2Fimage.png?alt=media\&token=2ba8baff-b40b-4dd4-ae2c-2a2ad5696788) - Data you want to analyze. 

### Output data <a href="#output-data" id="output-data"></a>

![](https://965373739-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FkxZeV4nlXcIAjMGZxzLI%2Fuploads%2FklOFiuy6JN0H0QKdGcly%2Fimage.png?alt=media\&token=4daad3b3-866e-4e41-84a2-21d13c97db17) - Count of the specified character, word, or pattern you searched for.

***

## Parameters

These are the parameters you need to configure to use this operation (mandatory parameters are marked with a <mark style="color:red;">**\***</mark>):

<details>

<summary>Search<mark style="color:red;"><strong>*</strong></mark></summary>

Enter the specific character, word, or pattern you want to count.

</details>

<details>

<summary>Search Type<mark style="color:red;"><strong>*</strong></mark></summary>

Select the type of search you want to perform. The available options are:

* **Regex** - Choose this option if you want to use regular expressions.
* **Extended** - Choose this option for extended regular expressions. An extended regular expression specifies a set of strings to be matched. The expression contains both text characters and operator characters.
* **Simple** - Choose this option if you want to perform a simple string matching. Note that this search type is **not case-sensitive** (*A* is different from *a*).

</details>

***

## Examples

<details>

<summary>Simple search example</summary>

Suppose you want to check the number of occurrences of the term `test` in a series of events:

1. In your Pipeline, open the required [Action](https://docs.onum.com/the-workspace/pipelines/actions) configuration and select the input **Field**.
2. In the **Operation** field, choose **Count occurrences**.
3. Set **Search** to `test`.
4. Set **Search Type** to `simple`.
5. Give your **Output field** a name and click **Save**. The count will be displayed in the output field.

In this example, given the following string:

```
Accepted password for test domain
```

The result count will be **1**.

</details>

<details>

<summary>RegEx search example</summary>

Suppose you want to count words that start with the letter "c" (either small or capital) in your input data:

1. In your Pipeline, open the required [Action](https://docs.onum.com/the-workspace/pipelines/actions) configuration and select the input **Field**.
2. In the **Operation** field, choose **Count occurrences**.
3. Set **Search** to `\b[Cc]\w*`.
4. Set **Search Type** to `regex`.
5. Give your **Output field** a name and click **Save**. The count will be displayed in the output field.

In this example, given the following string:

<pre><code><strong>Core temperature above threshold, CPU clock throttled
</strong></code></pre>

The result count will be **3**.

**RegEx explanation:**

* `\b` matches a word boundary, ensuring the match starts at the beginning of a word.
* `C` matches the letter "c."
* `\w*` matches any number of alphanumeric characters after "C," effectively capturing entire words.

</details>

<details>

<summary>Extended RegEx search example</summary>

Suppose you want to get the occurrences of the word "error" but not if it’s followed by "404". To do it:

1. In your Pipeline, open the required [Action](https://docs.onum.com/the-workspace/pipelines/actions) configuration and select the input **Field**.
2. In the **Operation** field, choose **Count occurrences**.
3. Set **Search** to `error(?!\s404)`.
4. Set **Search Type** to `extended`.
5. Give your **Output field** a name and click **Save**. The count will be displayed in the output field.

In this example, given the following strings:

<pre><code><strong>error404 - 404 is an error that tells a web is not available.
</strong></code></pre>

The result count will be **2**.

**RegEx explanation:**

* `error` matches the word "error."
* `(?!\s404)` is a negative lookahead that ensures "error" is not followed by " 404".

</details>

{% hint style="info" %}
You can try out operations with specific values using the **Input** field above the operation. You can enter the value in the example above and check the result in the **Output** field.
{% endhint %}