How to group values using wildcard

[gokikrishnan198]

index=**** Name=GOKI|stats count by SK SO
This is the result that I get now.

SK                    SO         COUNT
d.e.f                 B3           2
a.b.c.1             A1            4
a.b.c.2             A2            6
a.b.c.3            A1             8

Expected Result:

d.e.f                 B3           2
a.b.c.*              A1          12
a.b.c.*              A2           6

How do I get the expected result?

[woodcock]

Like this:

index=**** Name=GOKI
| rex field=SK mode=sed "s/^(\d\.\d\.\d\.)/\1.*/"
| stats count by SK SO

[Toby_r]

Thanks, that works fine! but how do I Add this "OR" function --> so counting AB* OR BA* as one count

[martin_mueller]

Make your SK values be what you want them to be before summing up. Depending on the actual rules for wildcarding it might look something like this: index=**** Name=GOKI | eval SK = replace(SK, "^(\w+\.\w+\.\w+\.).+", "\1.*") |stats count by SK SO