Splunk Search

How to edit my search to count the number of servers?

New Member

We have Multiple servers that all end with the same few letters like this.


I want to return results that look like this

OfficeServer 10
RemotServer 23

index=stuff* host=*SERVER "Deployed successfully" | cluster t=0.35 field=host

Is that possible and if so, what do I change my search to?

0 Karma

Super Champion

if they all end with "Server", you could adding something like:

|rex field=host mode=sed "/s/\d+Server/Server/" 
0 Karma


Using cluster is likely going to give you an indeterminate result. Instead, you can create a new field by ripping out the numbers and then get the counts.

Try this.

index=stuff* host=*SERVER "Deployed successfully" 
| eval newhost = replace(host, "(\D+)(\d+)(\D+)","\1\3") 
| stats count by newhost
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!