How to include a field in a count if it has some particular text?

[hastrike]

I have pulled a list of all the Operating systems in the environment. Although, they are all server 2008, for example, some are standard, enterprise, datacenter, etc.... Did a stats count to get a count of the number of each operating system in the environment. However, I would like to combine the stats count results for anything that is just Server 2008, 2012, or XP. How can I combine these results into one entry for Server 2008 and then one for server 2012? The count values would then combine as well.

In Excel I know I can do a count If (COLUMN, "*2008*") and it will count anything that has 2008 in the OS column. Is there anything like that in Splunk?

[somesoni2 · Accepted solution]

Try something like this

your current search with stats giving fields osType and count | eval osType=case(like(osType,"%2008%"),"Win Server 2008",like(osType,"%2012%"),"Win Server 2008",1=1."Windows XP") | stats sum(count) as count by osType

[hastrike]

Thank you for the input