How to edit my search to count the number of servers?

[lbonnes]

We have Multiple servers that all end with the same few letters like this.

Office1Server
Office2Server
Remot1Server
Remot2Server
Remot3Server

I want to return results that look like this

OfficeServer 10
RemotServer 23

index=stuff* host=*SERVER "Deployed successfully" | cluster t=0.35 field=host

Is that possible and if so, what do I change my search to?

[cmerriman]

if they all end with "Server", you could adding something like:

|rex field=host mode=sed "/s/\d+Server/Server/" 

[rjthibod]

Using cluster is likely going to give you an indeterminate result. Instead, you can create a new field by ripping out the numbers and then get the counts.

Try this.

index=stuff* host=*SERVER "Deployed successfully" 
| eval newhost = replace(host, "(\D+)(\d+)(\D+)","\1\3") 
| stats count by newhost