Splunk Search

How to group values using wildcard

gokikrishnan198
New Member

index=**** Name=GOKI|stats count by SK SO
This is the result that I get now.

SK                    SO         COUNT
d.e.f                 B3           2
a.b.c.1             A1            4
a.b.c.2             A2            6
a.b.c.3            A1             8

Expected Result:

d.e.f                 B3           2
a.b.c.*              A1          12
a.b.c.*              A2           6

How do I get the expected result?

0 Karma

woodcock
Esteemed Legend

Like this:

index=**** Name=GOKI
| rex field=SK mode=sed "s/^(\d\.\d\.\d\.)/\1.*/"
| stats count by SK SO
0 Karma

Toby_r
Loves-to-Learn

Thanks, that works fine! but how do I Add this "OR" function --> so counting AB* OR BA* as one count

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Make your SK values be what you want them to be before summing up. Depending on the actual rules for wildcarding it might look something like this: index=**** Name=GOKI | eval SK = replace(SK, "^(\w+\.\w+\.\w+\.).+", "\1.*") |stats count by SK SO

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...