We have Multiple servers that all end with the same few letters like this.
I want to return results that look like this
index=stuff* host=*SERVER "Deployed successfully" | cluster t=0.35 field=host
Is that possible and if so, what do I change my search to?
if they all end with "Server", you could adding something like:
|rex field=host mode=sed "/s/\d+Server/Server/"
Using cluster is likely going to give you an indeterminate result. Instead, you can create a new field by ripping out the numbers and then get the counts.
index=stuff* host=*SERVER "Deployed successfully"
| eval newhost = replace(host, "(\D+)(\d+)(\D+)","\1\3")
| stats count by newhost