Splunk Search

count by wildcard in field value

Toby_r
Loves-to-Learn

Hi,

I've following issue: Ive a dataset containing data like
Order number = 12345
Description = "AB: jdkjsd"
planned_date="12.3.2020"

Order number = 12346
Description = "BC: jdkjsd"
planned_date="12.3.2020"

Order number = 12347
Description = "BA: jdkjsd"
planned_date="12.3.2020"

 

now I'd like to have a table which counts me the number of events for "BC:*", "AB:*" OR "BA:*",... and so on - I'm quite new and google didnt helped me, can someone help? Thanks!

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| rex field=Description "(?<prefix>\w+)\:"
| stats count by prefix
0 Karma
Get Updates on the Splunk Community!

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...

Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...