How do you combine similar Items in a search?

[balcv]

I have a scenario where I have a data set that contains user ids, among other things, but there are two possible versions of the user id that I would like to be able to combine into a single search result.
For example, user id could be d1\123456 and it could be d2\123456. This is the same user just from a different domain.

index="pan" | stats count by user | sort -count

This will result in a separate line for every unique user

d1\123456      45
d2\123456      83

I would like to be able to get a single line for user 123456 irrespective of the domain (d1 or d2).

123456         128

Is this possible?

[woodcock · Accepted solution]

Like this:

index="pan"
| rex field=user mode=sed "s/.*\\\//"
| stats count by user
| sort 0 -count

[balcv]

@woodcock, thank you, that is exactly what I was after. Simple when you know how.

[vnravikumar]

Hi

Try like

| makeresults 
| eval msg="d1\\123456,d2\\123456" 
| makemv delim="," msg 
| rex field=msg "\\\(?P<user>[\d]+)" 
| stats count by user 
| sort -count

[balcv]

Thanks for the response @vnravikumar . What I think I omitted was that the data set will contain hundreds of user ids in the format domain\userid and there could be user ids with just d1, some with just d2 or some with both.

I'm looking for search results showing the unique user ids combining those that have both d1 and d2 while still listing those with just the single domain.

Also, the user id can be both numeric and alpha. (eg some as 123456 others as ajones with the d1 and/or d2 domain).

[vnravikumar]

Hi

Try this, if not worked give some sample user ids

| makeresults 
| eval msg="d1\\123456,d2\\123456,ajones,123456" 
| makemv delim="," msg 
| rex field=msg "(\w+\\\){0,1}(?P<user>[\w]+)" 
| stats count by user 
| sort -count