Stats Count by field and add (SUM) some result

[bricevaixagon]

Hello,

I am doing a search listing all the browsers.

However, I have browsers of the type :
ChromeHTML.FDCH......
ChromeHTML
ChromeHTML.2E7......

etc...
Same for Firefox

I would like to be able to count the number of browsers, but make sure to add the values of all the chromes, firefox in a single line.

index=sccm sourcetype=SSCM_BROWSER_DEFAULT | stats count by BrowserProgId00

BrowserProgId00 nombre
AppXq0fevzme2pys62n3e0fbqa7peapykr8v 60
ChromeHTML 59
ChromeHTML.2E7BJ435KINKES6NGIB4DK2T4I 1
ChromeHTML.FDC5HC2IB7LJMPRMP7GYAKM6SQ 1
ChromeHTML.HABVCVEOPXUP33DZQHA662NR7M 1
ChromeHTML.K6GMCADI6IMQKFTSTIZJEGJMXM 1
ChromeHTML.KH3IIUAXKFTEPVVKFVNKLM2XZ4 1

I would like ==>
BrowserProgId00 nombre
AppXq0fevzme2pys62n3e0fbqa7peapykr8v 60
Chrome 64
etc..

Thanks.

[somesoni2]

You could do something like this. I'm using a static list of all possible browser in the eval-case command. If your base browser name follows some pattern, you could extract that and assign category.

index=sccm sourcetype=SSCM_BROWSER_DEFAULT | stats count by BrowserProgId00
| eval Browser=case(match(BrowserProgId00,"Chrome","Chrome",
match(BrowserProgId00,"Firefox","Firefox",
match(BrowserProgId00,"Safari","Safari",
....add more browser values per your data...,
true(),"Unknown")
| stats sum(count) as count by Browser