Help on Splunk query

[suvi6789]

Hi, 
I have 4 fields in my index 
ID, Method, URL, HTTP_responsecode

ID is in the form of XXXX-YYYY-ZZZZ-AAAA, 
Now, I want to delimit the ID column and extract YYYY value then run a stats command with the delimited value by HTTP_responsecode

Something as below 

Delimited_ID	HTTP_responsecode	Count
YYYY	200	10

Please could you help on how to delimit the value in the above format mentioned and how to use the new delimited value in a stats command 

[richgalloway]

There are a couple of ways to get the desired field from the ID.

| rex field=ID "-(?<Delimited_ID>[^-]+)"
``` OR ```
| eval tmp = split(ID, "-")
| eval Delimited_ID = mvindex(tmp,1)

Use the new field in a stats command just as you would any other field.

| stats count as Count by Delimited_ID, HTTP_responsecode