stats count returning servers more than once using dedup

[Thomas2]

Trying to get a count of servers sending logs to an index "cloud_servers", Running this command to get the count:
index=cloud_servers | search host="*server_name-h-nk01-*" | dedup host | stats count
The problem is, some servers it's counting twice because the server names appear with and without a fqdn depending on the type of log being sent.  So dedup doesn't work since technically it is a unique host.  
Example of the same server appearing with two host names:
host buffnybd1-h-nk01-555
host buffnybd1-h-nk01-555.nyny.os1.com
Is there a way to count the server just using the first 20 or so digits, so it will ingore the fqdn?
Thank you

[gcusello · Accepted solution]

Hi @Thomas2 ,

at first don't use the search command after the mai nsearch.

then anyway, you can use the rex command to extract the first part of the field or eval to use the first 20 chars.

index=cloud_servers host="*server_name-h-nk01-*"
| rex field=host "^(?<host>[^\.]+)"
| stats dc(host) AS count

Ciao.

Giuseppe

[Thomas2]

Yes this worked, thank you very much

[Thomas2]

Let me give this a try.  Thank you, Giuseppe

[gcusello]

Hi @Thomas2 ,

conferming what @bowesmana pointed out, 

let us know if we can help you more, or, please, accept one answer for the other people of Community.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated by all the Contributors 😉

[bowesmana]

Also unless you absolutely have to, avoid using leading wildcards in the search term host="*..."

[Thomas2]

Yes I took out the leading *.  Thank you much