https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319389#M95499 <P>that worked thanks a lot </P> Mon, 27 Feb 2017 10:54:47 GMT rvinjana 2017-02-27T10:54:47Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319387#M95497 <P>I have a search with multiple extensions in a field which, i want to group details based on the extensions in filepath and also count based on the extensions in the filepath </P> <P>devicename time fileHash filePath=.txt , .exe , .js etc </P> <P>any help would be appreciated </P> Mon, 27 Feb 2017 05:27:43 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319387#M95497 rvinjana 2017-02-27T05:27:43Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319388#M95498 <P>Just tried with a small subset. Have a try using your dataset and let us know the results</P> <PRE><CODE>index=_internal| stats count by source| rex field=source "\.(?&lt;extn&gt;[^\\\|^\/|^\.]+$)"| stats count by extn </CODE></PRE> <P>so in your case, the actual search would be something like</P> <PRE><CODE>&lt;your search&gt; | rex field=filePath "\.(?&lt;extn&gt;[^\\\|^\/|^\.]+$)"| stats count by extn </CODE></PRE> Mon, 27 Feb 2017 10:20:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319388#M95498 koshyk 2017-02-27T10:20:19Z https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319389#M95499 <P>that worked thanks a lot </P> Mon, 27 Feb 2017 10:54:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-generate-a-search-to-display-the-count-of-a-field-based/m-p/319389#M95499 rvinjana 2017-02-27T10:54:47Z