https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-same-values-within-a-field/m-p/541347#M153269 <P>Hi,&nbsp;</P><P>I have a field with multiple values, some of them share the same characters at the beginning of the values.&nbsp;</P><P>I need to find those with the same values and make it possible to choose how many characters I want to compare from the beginning of the value.</P> Thu, 25 Feb 2021 14:14:52 GMT ynag 2021-02-25T14:14:52Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-same-values-within-a-field/m-p/541347#M153269 <P>Hi,&nbsp;</P><P>I have a field with multiple values, some of them share the same characters at the beginning of the values.&nbsp;</P><P>I need to find those with the same values and make it possible to choose how many characters I want to compare from the beginning of the value.</P> Thu, 25 Feb 2021 14:14:52 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-same-values-within-a-field/m-p/541347#M153269 ynag 2021-02-25T14:14:52Z https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-same-values-within-a-field/m-p/541359#M153272 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/231891">@ynag</a>&nbsp;,<BR /><BR />You can use <STRONG>substr</STRONG> function to get the first n characters. Below query get first 5 characters from myfield values.&nbsp;</P><LI-CODE lang="markup">index=index | eval substr=substr(myfield, 0, 5) | stats list(myfield), count by substr</LI-CODE><P>&nbsp;</P><P>If this reply helps you, an upvote/like would be appreciated.&nbsp;</P> Thu, 25 Feb 2021 15:07:38 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-search-for-same-values-within-a-field/m-p/541359#M153272 manjunathmeti 2021-02-25T15:07:38Z