Normalise the values of a field and joining the event count of the field values

[sumaitasiddiky1]

Hi, I have a list of Tenants and the data is being pulled from Jira labels.

Some of the labels have not been spelled right . For example, one of the Tenants PLATFORM have been labelled as PLAFORM, PLATFROM, PLATFORMATFORM. Each of these labels have an event associated with it.

There are many Tenants like this. I want a query to merge these Values and events of Tenant field as ONE.

There are 99 more Tenants so I want a query that I can apply for other Tenant values normalisation as well.

At the moment the view is :

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

I want it like :

Tenant Count
PLATFORM 29

[koshyk]

So from the existing output.. say

Tenant Count
PLAFORM 6
PLATFROM 8
PLATFORMATFROM 15

do a

... | eval Tenant=if(like(Tenant, "PLA%"), "PLATFORM", "UNKNOWN")
| stats sum(Count) as Tenant_Count  by Tenant