Splunk Search
Highlighted

How to group values using wildcard

New Member

index=**** Name=GOKI|stats count by SK SO
This is the result that I get now.

SK                    SO         COUNT
d.e.f                 B3           2
a.b.c.1             A1            4
a.b.c.2             A2            6
a.b.c.3            A1             8

Expected Result:

d.e.f                 B3           2
a.b.c.*              A1          12
a.b.c.*              A2           6

How do I get the expected result?

0 Karma
Highlighted

Re: How to group values using wildcard

SplunkTrust
SplunkTrust

Make your SK values be what you want them to be before summing up. Depending on the actual rules for wildcarding it might look something like this: index=**** Name=GOKI | eval SK = replace(SK, "^(\w+\.\w+\.\w+\.).+", "\1.*") |stats count by SK SO

0 Karma
Highlighted

Re: How to group values using wildcard

Esteemed Legend

Like this:

index=**** Name=GOKI
| rex field=SK mode=sed "s/^(\d\.\d\.\d\.)/\1.*/"
| stats count by SK SO
0 Karma