topic How to group values using wildcard in Splunk Search

How to group values using wildcard

gokikrishnan198 — Wed, 11 Jul 2018 07:14:10 GMT

index=**** Name=GOKI|stats count by SK SO
This is the result that I get now.

SK                    SO         COUNT
d.e.f                 B3           2
a.b.c.1             A1            4
a.b.c.2             A2            6
a.b.c.3            A1             8

Expected Result:

d.e.f                 B3           2
a.b.c.*              A1          12
a.b.c.*              A2           6

How do I get the expected result?

Re: How to group values using wildcard

martin_mueller — Wed, 11 Jul 2018 09:29:05 GMT

Make your SK values be what you want them to be before summing up. Depending on the actual rules for wildcarding it might look something like this: index=**** Name=GOKI | eval SK = replace(SK, "^(\w+\.\w+\.\w+\.).+", "\1.*") |stats count by SK SO

Re: How to group values using wildcard

woodcock — Wed, 11 Jul 2018 16:58:18 GMT

Like this:

index=**** Name=GOKI
| rex field=SK mode=sed "s/^(\d\.\d\.\d\.)/\1.*/"
| stats count by SK SO

Re: How to group values using wildcard

Toby_r — Thu, 26 Nov 2020 11:14:32 GMT

Thanks, that works fine! but how do I Add this "OR" function --> so counting AB* OR BA* as one count