Splunk Search

count by wildcard in field value

Toby_r
Loves-to-Learn

Hi,

I've following issue: Ive a dataset containing data like
Order number = 12345
Description = "AB: jdkjsd"
planned_date="12.3.2020"

Order number = 12346
Description = "BC: jdkjsd"
planned_date="12.3.2020"

Order number = 12347
Description = "BA: jdkjsd"
planned_date="12.3.2020"

 

now I'd like to have a table which counts me the number of events for "BC:*", "AB:*" OR "BA:*",... and so on - I'm quite new and google didnt helped me, can someone help? Thanks!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Description "(?<prefix>\w+)\:"
| stats count by prefix
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...