How to group similar results from one field?

[MikeB]

Hello! I'm hoping some Splunk masters can help me with what I thought would have been an easy task but I'm very much stuck on it.  How can I group similar starting results into one result within the same field? I have a field that spits out results formatted like this:

index=prod_side sourcetype=prod_one  fail_code=* | table fail_code

Results:

fail_code
c-tr [213]
c-tr [893]
c-tr [309]
e-hw [gold]
e-hw [silver]
e-hw [bronze]
e-pr [vbix]
e-pr [zbix]
g-tr [345]
g-tr [123]
d-st [(intel.arm64) T 123 123]
d-st [(intel.arm64) T 456 456]

I want to group results and count the total for each by the 4 characters before the brackets [ ] begin. The content in the brackets is not relevant to me and can be done away with in the results table:

fail_code_name     value_count
c-tr                                  3
e-hw                               3
e-pr                                 2
g-tr                                  2
d-st                                 2

[richgalloway · Accepted solution]

There likely are several ways to do that.  I like to use rex to extract the interesting bits into a separate field and then group by that field.

index=prod_side sourcetype=prod_one  fail_code=*
| rex field=fail_code "(?<fail_code_name>[^\[]+)"
| stats count as value_count by fail_code_name
| table fail_code_name value_count

[MikeB]

This is fantastic! If I may, how would I write a regular expression to capture groups by the first two characters? Like if I just wanted:

fail_code_name     
c-                                        
d-
e-

I also have several values that are:
c-tr [1234] 
c-tr [6532]
c-ds [4567]
c-pd [8791]
d-st [6549]
d-ty [6321]
d-pr [8912]
e-hw [3691]
e-rt [8742]
e-zx [9911]

[PickleRick]

Regex for first two characters of a string is relatively easy

^.{2}

But I suppose using ane eval with substring function would be marginally more effective (regexps as such are quite a heavy machinery)

[MikeB]

Thank you! That was good advice. For future finders of this post you would replace the following:

From: 

| rex field=fail_code "(?<fail_code_name>[^\[]+)"

To this: 

| rex field=fail_code "(?<fail_code_name>^.{2}+)"