https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363905#M107435 <P>What happens if I know there are many string repetitions in the results? Someway to merge all of them together without having to do an <CODE>eval</CODE> for every string?</P> Mon, 26 Jun 2017 22:23:53 GMT exocore123 2017-06-26T22:23:53Z https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363903#M107433 <P>I want to merge values with similar string context and still be able to reverse search for those logs. Similar to this </P> <P>The stats count look something like this</P> <PRE><CODE>error count invalid input 25 price "1.24" does not match "1.21" 1 price "1.00" does not match "1.01" 1 price "1.34" does not match "3.21" 1 external services 15 </CODE></PRE> <P>I want it to look something like</P> <PRE><CODE>error count invalid input 25 price * does not match * 3 external services 15 </CODE></PRE> <P>When say I want to find the logs matches "price __ does not match __ " I can see the list of specific logs combined</P> Mon, 26 Jun 2017 16:20:35 GMT https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363903#M107433 exocore123 2017-06-26T16:20:35Z https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363904#M107434 <P>If you know all the patterns which you want to merge, like <CODE>price "N1" does not match "N2"</CODE>, then you use use eval replace command before your stats command to make them similar.</P> <PRE><CODE>Your base search before stats | eval error=replace(error,"(price )\S+( does not match )\S+","\1*\2*") | stats count by error </CODE></PRE> <P>If it throws error, escape the asterisk with <CODE>\</CODE> in replace command.</P> Mon, 26 Jun 2017 16:32:29 GMT https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363904#M107434 somesoni2 2017-06-26T16:32:29Z https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363905#M107435 <P>What happens if I know there are many string repetitions in the results? Someway to merge all of them together without having to do an <CODE>eval</CODE> for every string?</P> Mon, 26 Jun 2017 22:23:53 GMT https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363905#M107435 exocore123 2017-06-26T22:23:53Z https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363906#M107436 <P>@exocore123 have you found the way to merge all of them without using an <CODE>eval</CODE>?</P> Thu, 30 Apr 2020 03:43:07 GMT https://community.splunk.com/t5/Splunk-Search/Merging-values-with-similar/m-p/363906#M107436 chiilii 2020-04-30T03:43:07Z