https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367112#M169879 <P>Thanks for the quick response!!! This is close but I'm looking to sort on publishId=*U and *S....just the aggregate of those two.</P> <P>Currently: I have multiple publishId's..<BR /> publishId tile launches<BR /> 1d Tile1 5<BR /> 2y Tile2 8<BR /> 3r Tile3 3<BR /> 4h Tile4 1<BR /> ...etc</P> <P>Desired result:<BR /> publishId tile launches<BR /> S Tile1 25<BR /> Tile2 58<BR /> Tile3 63<BR /> Tile4 81</P> <P>publishId tile launches<BR /> U Tile1 35<BR /> Tile2 98<BR /> Tile3 63<BR /> Tile4 21</P> Fri, 27 Apr 2018 21:26:41 GMT dwong2 2018-04-27T21:26:41Z https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367110#M169877 <P>...search<BR /> | stats count(tile) as launches by tile publishId<BR /> | sort -"launches"</P> <P>accountExId: 12345678<BR /><BR /> publishId: 63020U or 63020S<BR /><BR /> tile: Tile1 </P> <P>How do I get results so that it will look similiar to this:</P> <P>publishId tile launches<BR /> *S Tile1 4<BR /> Tile2 6<BR /> Tile3 8</P> <P>publishId tile launches<BR /> *U Tile1 8<BR /> Tile2 1<BR /> Tile3 10</P> Fri, 27 Apr 2018 21:06:39 GMT https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367110#M169877 dwong2 2018-04-27T21:06:39Z https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367111#M169878 <P>Try this</P> <PRE><CODE>...search | stats count(tile) as launches by tile publishId | sort -"launches" by publishId | stats list(tile) as tile list(launches) as launches by publishId </CODE></PRE> Fri, 27 Apr 2018 21:14:37 GMT https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367111#M169878 somesoni2 2018-04-27T21:14:37Z https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367112#M169879 <P>Thanks for the quick response!!! This is close but I'm looking to sort on publishId=*U and *S....just the aggregate of those two.</P> <P>Currently: I have multiple publishId's..<BR /> publishId tile launches<BR /> 1d Tile1 5<BR /> 2y Tile2 8<BR /> 3r Tile3 3<BR /> 4h Tile4 1<BR /> ...etc</P> <P>Desired result:<BR /> publishId tile launches<BR /> S Tile1 25<BR /> Tile2 58<BR /> Tile3 63<BR /> Tile4 81</P> <P>publishId tile launches<BR /> U Tile1 35<BR /> Tile2 98<BR /> Tile3 63<BR /> Tile4 21</P> Fri, 27 Apr 2018 21:26:41 GMT https://community.splunk.com/t5/Splunk-Search/Separate-out-results-based-on-wildcard-field/m-p/367112#M169879 dwong2 2018-04-27T21:26:41Z