Splunk Search

Wildcard Match Count

AHEARNJ
Explorer

I am trying to use a match, regex, or eval with a stats count.
I have multiple values that are similar that are in the same column along with other values that I want kept.
Here is an example of some of the data

name="User: Employee FirstName LastName", 
name="User: Employee FirstName1 LastName1",
name="User: Employee FirstName2 LastName2",
name="Office 365"
name="Word"
name="Google"

I would like to be able to do a

... | stats count by name eval User [regex] replace ""User: Employee FirstName LastName"...  x3  with User

Results:
Office 365 1
Word 1
Google 1
User 3
I have tried many ways, but can't seem to get this to work as I would like.

Thanks in advance for any help you can provide...

0 Karma
1 Solution

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name

View solution in original post

0 Karma

DalJeanis
Legend

Assuming that you want every user to come out on the same line, labeled as User...

Try this -

 | rex mode=sed field=name "s/^User.*$/User/"
 | stats count by name
0 Karma

AHEARNJ
Explorer

Thanks DalJeanis that was quick and exactly what I needed.

DalJeanis
Legend

We're happy to help.

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...