Splunk Search

Wildcard Match Count

AHEARNJ
Explorer

I am trying to use a match, regex, or eval with a stats count.
I have multiple values that are similar that are in the same column along with other values that I want kept.
Here is an example of some of the data

name="User: Employee FirstName LastName", 
name="User: Employee FirstName1 LastName1",
name="User: Employee FirstName2 LastName2",
name="Office 365"
name="Word"
name="Google"

I would like to be able to do a

... | stats count by name eval User [regex] replace ""User: Employee FirstName LastName"...  x3  with User

Results:
Office 365 1
Word 1
Google 1
User 3
I have tried many ways, but can't seem to get this to work as I would like.

Thanks in advance for any help you can provide...

0 Karma
1 Solution

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name

View solution in original post

0 Karma

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name
0 Karma

AHEARNJ
Explorer

Thanks DalJeanis that was quick and exactly what I needed.

DalJeanis
Legend

We're happy to help.

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...