Splunk Search

Wildcard Match Count

AHEARNJ
Explorer

I am trying to use a match, regex, or eval with a stats count.
I have multiple values that are similar that are in the same column along with other values that I want kept.
Here is an example of some of the data

name="User: Employee FirstName LastName", 
name="User: Employee FirstName1 LastName1",
name="User: Employee FirstName2 LastName2",
name="Office 365"
name="Word"
name="Google"

I would like to be able to do a

... | stats count by name eval User [regex] replace ""User: Employee FirstName LastName"...  x3  with User

Results:
Office 365 1
Word 1
Google 1
User 3
I have tried many ways, but can't seem to get this to work as I would like.

Thanks in advance for any help you can provide...

0 Karma
1 Solution

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name

View solution in original post

0 Karma

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name
0 Karma

AHEARNJ
Explorer

Thanks DalJeanis that was quick and exactly what I needed.

DalJeanis
Legend

We're happy to help.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...