I have an query that
index ="main" |stats count by Text |sort -count | table count Text
results:
count | Text |
10 | dog fish |
20 | dog cat |
How can I change the compare that compare first X chars into Text , for example first 4 chars , so "dog fish" and "dog cat" will be 1 line?
count | Text |
30 | dog ..... |
index ="main" |eval Text=substr(Text,1,4)|stats count by Text |sort -count | table count Text
index ="main" |eval Text=substr(Text,1,4)|stats count by Text |sort -count | table count Text
And how can I add "..." as a suffix ?
update Text eval
|eval Text=substr(Text,1,4)."...."