https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402119#M116379 <P>How do I make that work on an enterprise query that uses an index? ie "index=mylog path='/routeX/*' ?</P> Thu, 10 Jan 2019 18:33:11 GMT wfresch 2019-01-10T18:33:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402112#M116372 <P>Suppose I have the following data, but I don't know the GUIDs ahead of time:</P> <P>Path</P> <PRE><CODE>/boat/826ec68b-cc87-41f9-b93b-5bfae6f21c52/duck /car/39bdd442-167b-46b0-95fd-1e8e0423e7f8/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/cat /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a </CODE></PRE> <P>I'd like to get counts like this:</P> <PRE><CODE>Count Path 1 /boat/*/duck 2 /car/*/fox 1 /car/*/cat 1 /car/* </CODE></PRE> <P>Is this possible? I can even get <EM>close</EM> to this. I'd be happy — like, a count of 4 for "/car/*" would still be better than nothing.</P> Thu, 10 Jan 2019 14:54:26 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402112#M116372 wfresch 2019-01-10T14:54:26Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402113#M116373 <P>Hi Martin,</P> <P>Please find below the run anywhere query, one question is your path format is always same? if not we can think about negative indexing in mvindex. </P> <PRE><CODE>| makeresults count=5 | rename comment as "start of data preparation" | streamstats count as id | eval path = case(id=1,"/boat/826ec68b-cc87-41f9-b93b-5bfae6f21c52/duck",id=2,"/car/39bdd442-167b-46b0-95fd-1e8e0423e7f8/fox",id=3,"/car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/cat",id=4,"/car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/fox",id=5,"/car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a") | table path | eval splitted_path = split(path,"/") | eval needed_path = "/".mvindex(splitted_path,1)."/".if(isnull(mvindex(splitted_path,3))," ",mvindex(splitted_path,3)) | stats count by needed_path </CODE></PRE> <P>Sid</P> Thu, 10 Jan 2019 15:56:06 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402113#M116373 sdchakraborty 2019-01-10T15:56:06Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402114#M116374 <P>Like this:</P> <PRE><CODE>| makeresults | eval path = "/boat/826ec68b-cc87-41f9-b93b-5bfae6f21c52/duck /car/39bdd442-167b-46b0-95fd-1e8e0423e7f8/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/cat /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a/fox /car/2c2d27d4-4c07-460e-8c0e-11aad4e4c34a" | makemv path | mvexpand path | rename COMMENT AS "Everything above generates sample event data; everything below is your solution" | eval orig_path = path | rex field=path mode=sed "s%(/[^/]+)/[^/]+%\1%" | stats count by path </CODE></PRE> Thu, 10 Jan 2019 16:25:27 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402114#M116374 woodcock 2019-01-10T16:25:27Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402115#M116375 <P>will this work, even if I don't know the actual GUIDs ahead of time?</P> Thu, 10 Jan 2019 17:12:45 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402115#M116375 wfresch 2019-01-10T17:12:45Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402116#M116376 <P>will this work, even if I don't know the actual GUIDs ahead of time?</P> Thu, 10 Jan 2019 17:13:01 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402116#M116376 wfresch 2019-01-10T17:13:01Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402117#M116377 <P>Yes, it blindly strips off everything between the 2nd and 3rd <CODE>/</CODE> character (including one of the <CODE>/</CODE> characters).</P> Thu, 10 Jan 2019 17:15:55 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402117#M116377 woodcock 2019-01-10T17:15:55Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402118#M116378 <P>Yes it will work.</P> Thu, 10 Jan 2019 17:22:33 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402118#M116378 sdchakraborty 2019-01-10T17:22:33Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402119#M116379 <P>How do I make that work on an enterprise query that uses an index? ie "index=mylog path='/routeX/*' ?</P> Thu, 10 Jan 2019 18:33:11 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402119#M116379 wfresch 2019-01-10T18:33:11Z https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402120#M116380 <P>Use your search and then add on lines 8-10 of my solution.</P> Thu, 10 Jan 2019 19:00:17 GMT https://community.splunk.com/t5/Splunk-Search/How-do-you-get-counts-with-wildcards/m-p/402120#M116380 woodcock 2019-01-10T19:00:17Z