Splunk Search

How can I search for same values within a field



I have a field with multiple values, some of them share the same characters at the beginning of the values. 

I need to find those with the same values and make it possible to choose how many characters I want to compare from the beginning of the value.

Labels (2)
Tags (2)
0 Karma


hi @ynag ,

You can use substr function to get the first n characters. Below query get first 5 characters from myfield values. 

| eval substr=substr(myfield, 0, 5) 
| stats list(myfield), count by substr


If this reply helps you, an upvote/like would be appreciated. 

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...