topic Re: Count by start of string in Splunk Search https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561204#M159511 <LI-CODE lang="markup">index ="main" |eval Text=substr(Text,1,4)|stats count by Text |sort -count | table count Text</LI-CODE> Wed, 28 Jul 2021 14:48:26 GMT ITWhisperer 2021-07-28T14:48:26Z Count by start of string https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561202#M159510 <P>I have an query that</P><P>index ="main" |stats count by Text |sort -count | table count Text</P><P>results:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%">count</TD><TD width="50%">Text</TD></TR><TR><TD width="50%">10</TD><TD width="50%">dog fish</TD></TR><TR><TD width="50%">20&nbsp;</TD><TD width="50%">&nbsp; dog cat</TD></TR></TBODY></TABLE><P>&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;</P><P>&nbsp;</P><P>How can I change the compare that compare first X chars into Text , for example first 4 chars , so "dog fish" and "dog cat" will be 1 line?</P><P>&nbsp;</P><TABLE border="1" width="100%"><TBODY><TR><TD width="50%" height="25px">count</TD><TD width="50%" height="25px">Text</TD></TR><TR><TD width="50%" height="25px">30</TD><TD width="50%" height="25px">dog .....</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>&nbsp;</P> Wed, 28 Jul 2021 14:48:47 GMT https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561202#M159510 kooojo 2021-07-28T14:48:47Z Re: Count by start of string https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561204#M159511 <LI-CODE lang="markup">index ="main" |eval Text=substr(Text,1,4)|stats count by Text |sort -count | table count Text</LI-CODE> Wed, 28 Jul 2021 14:48:26 GMT https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561204#M159511 ITWhisperer 2021-07-28T14:48:26Z Re: Count by start of string https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561207#M159513 <P>And how can I add "..." as a suffix ?</P> Wed, 28 Jul 2021 14:55:10 GMT https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561207#M159513 kooojo 2021-07-28T14:55:10Z Re: Count by start of string https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561211#M159515 <P>update Text eval</P><LI-CODE lang="markup">|eval Text=substr(Text,1,4)."...."</LI-CODE><P>&nbsp;</P> Wed, 28 Jul 2021 15:06:30 GMT https://community.splunk.com/t5/Splunk-Search/Count-by-start-of-string/m-p/561211#M159515 kamlesh_vaghela 2021-07-28T15:06:30Z