https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/567593#M197822 <P>Thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P> Mon, 20 Sep 2021 06:39:12 GMT kelz 2021-09-20T06:39:12Z https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/566539#M197434 <P>Hello guys,</P><P>I need help building the query for this value to group it like the output I have given below.</P><P>Current:<BR />apple1<BR />apple-orange<BR />apple-yellow<BR />banna123<BR />banna-red<BR />banna-orange</P><P>Output:</P><P>apple*<BR />banna*</P> Fri, 10 Sep 2021 01:52:39 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/566539#M197434 kelz 2021-09-10T01:52:39Z https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/566591#M197448 <LI-CODE lang="markup">| makeresults | eval _raw="apple1 apple-orange apple-yellow banna123 banna-red banna-orange" | multikv noheader=t | table Column_1 | rename Column_1 as _raw | rex "(?&lt;fruit&gt;[a-zA-Z]+)"</LI-CODE><P>The rex puts the fruit into a field which you can then group by as you need</P> Fri, 10 Sep 2021 08:56:31 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/566591#M197448 ITWhisperer 2021-09-10T08:56:31Z https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/567593#M197822 <P>Thank you&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225168">@ITWhisperer</a>&nbsp;</P> Mon, 20 Sep 2021 06:39:12 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-of-value/m-p/567593#M197822 kelz 2021-09-20T06:39:12Z