How can I group results based on fixed String positions

[wandi]

bla xx bla Call Return: [20001TNSN NONONOONONO]

bla y bla Call Return: [20001TNSN NONONOONONO]

bla zzz bla Call Return: [40401FNSN NONONOONONO]

bla kk bla Call Return: [20001TNSN NONONOONONO]

bla y bla Call Return: [20001FNSN NONONOONONO]

A) first I like to count how many "T" and how many "F" I have. F or T are always the 6th position after "Call Return: [" sequence.

B) Is it possible also group the results for the three first numbers after the "Call Return: [" sequence? eg:

I like as a final result a graph with something like:

"200 F" => 1

"200 T" => 3

"404 F" => 1

[wandi]

wow!! I´m love with Splunk.

Thank you Damien.

[Damien_Dallimor]

We love you too 🙂

[Damien_Dallimor]

Try something like :

... | rex field=_raw "^.+Call\sReturn:\s+\[(?<sequence>\d{3})\d{2}(?<letter_code>[TF])" | stats count by sequence letter_code