Splunk Search

How to write a stats count search for events based on common (but variable) names?

DEAD_BEEF
Builder

I have a log file that lists which tool created the alert. I would like to count alerts by tool name, but I want to combine certain tool counts based on commonalities that I specify.

For example:

index=logs | stats count by Tools
McAfee Basic     12
Extreme McAfee   34
Plat McAfee Plus 6
Xerox IDS Base   1
Stumble IDS Plus 8
Microsoft X IDS  40

I would prefer to count based on tools having the word "McAfee" or "IDS" in them (so that they're grouped)

index=logs | some UNKNOWN QUERY
McAfee 52
IDS 49
Tags (4)
1 Solution

somesoni2
Revered Legend

Try this

index=logs | stats count(eval(match(Tools,"McAfee"))) as "McAfee" count(eval(match(Tools,"IDS"))) as IDS  

View solution in original post

somesoni2
Revered Legend

Try this

index=logs | stats count(eval(match(Tools,"McAfee"))) as "McAfee" count(eval(match(Tools,"IDS"))) as IDS  

wpreston
Motivator

Try this:

index=logs | stats count(eval(searchmatch("McAfee"))) as McAfee count(eval(searchmatch("IDS"))) as IDS
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...