https://community.splunk.com/t5/Splunk-Search/Can-I-perform-stats-count-on-a-substring-using-regex/m-p/367199#M108319 <P>I have log events such as activity:<A href="http://xyz/rest/876">http://xyz/rest/876</A><BR /> <A href="http://xyz/rest/223">http://xyz/rest/223</A><BR /> <A href="http://xyz/rest/263">http://xyz/rest/263</A><BR /> <A href="http://xyz/rest/4534">http://xyz/rest/4534</A><BR /> <A href="http://abc/rest/1">http://abc/rest/1</A><BR /> when I do stats count by activity I want to get results as:<BR /> <A href="http://xyz/rest">http://xyz/rest</A> 4<BR /> <A href="http://abc/rest">http://abc/rest</A> 1</P> <P>How can it be best done?</P> Wed, 27 Sep 2017 02:30:31 GMT chetan1974 2017-09-27T02:30:31Z https://community.splunk.com/t5/Splunk-Search/Can-I-perform-stats-count-on-a-substring-using-regex/m-p/367199#M108319 <P>I have log events such as activity:<A href="http://xyz/rest/876">http://xyz/rest/876</A><BR /> <A href="http://xyz/rest/223">http://xyz/rest/223</A><BR /> <A href="http://xyz/rest/263">http://xyz/rest/263</A><BR /> <A href="http://xyz/rest/4534">http://xyz/rest/4534</A><BR /> <A href="http://abc/rest/1">http://abc/rest/1</A><BR /> when I do stats count by activity I want to get results as:<BR /> <A href="http://xyz/rest">http://xyz/rest</A> 4<BR /> <A href="http://abc/rest">http://abc/rest</A> 1</P> <P>How can it be best done?</P> Wed, 27 Sep 2017 02:30:31 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-perform-stats-count-on-a-substring-using-regex/m-p/367199#M108319 chetan1974 2017-09-27T02:30:31Z https://community.splunk.com/t5/Splunk-Search/Can-I-perform-stats-count-on-a-substring-using-regex/m-p/367200#M108320 <P>Try this:</P> <PRE><CODE>| rex "(?&lt;activity&gt;http:\/\/[^\/]*\/rest)" | stats count as mycount by activity </CODE></PRE> Wed, 27 Sep 2017 17:42:39 GMT https://community.splunk.com/t5/Splunk-Search/Can-I-perform-stats-count-on-a-substring-using-regex/m-p/367200#M108320 DalJeanis 2017-09-27T17:42:39Z