https://community.splunk.com/t5/Splunk-Search/count-by-wildcard-in-field-value/m-p/530975#M149990 <P>Hi,</P><P>I've following issue: Ive a dataset containing data like<BR />Order number = 12345<BR />Description = "AB: jdkjsd"<BR />planned_date="12.3.2020"</P><P>Order number = 12346<BR />Description = "BC: jdkjsd"<BR />planned_date="12.3.2020"</P><P>Order number = 12347<BR />Description = "BA: jdkjsd"<BR />planned_date="12.3.2020"</P><P>&nbsp;</P><P>now I'd like to have a table which counts me the number of events for "BC:*", "AB:*" OR "BA:*",... and so on - I'm quite new and google didnt helped me, can someone help? Thanks!</P> Thu, 26 Nov 2020 09:21:14 GMT Toby_r 2020-11-26T09:21:14Z https://community.splunk.com/t5/Splunk-Search/count-by-wildcard-in-field-value/m-p/530975#M149990 <P>Hi,</P><P>I've following issue: Ive a dataset containing data like<BR />Order number = 12345<BR />Description = "AB: jdkjsd"<BR />planned_date="12.3.2020"</P><P>Order number = 12346<BR />Description = "BC: jdkjsd"<BR />planned_date="12.3.2020"</P><P>Order number = 12347<BR />Description = "BA: jdkjsd"<BR />planned_date="12.3.2020"</P><P>&nbsp;</P><P>now I'd like to have a table which counts me the number of events for "BC:*", "AB:*" OR "BA:*",... and so on - I'm quite new and google didnt helped me, can someone help? Thanks!</P> Thu, 26 Nov 2020 09:21:14 GMT https://community.splunk.com/t5/Splunk-Search/count-by-wildcard-in-field-value/m-p/530975#M149990 Toby_r 2020-11-26T09:21:14Z https://community.splunk.com/t5/Splunk-Search/count-by-wildcard-in-field-value/m-p/530976#M149991 <LI-CODE lang="markup">| rex field=Description "(?&lt;prefix&gt;\w+)\:" | stats count by prefix</LI-CODE> Thu, 26 Nov 2020 09:52:53 GMT https://community.splunk.com/t5/Splunk-Search/count-by-wildcard-in-field-value/m-p/530976#M149991 ITWhisperer 2020-11-26T09:52:53Z