title: How to search using a part of string in splunk and group by
body: <p>I need to create a report to show the processing time of certain events in splunk and in order to do that I need to get get all the relevant events and group by a id.</p>
  <p>My current splunk events are like</p>
  <pre><code>{
    &quot;Timestamp&quot;: &quot;Mon Sep 01 18:19:42 CDT 2020&quot;,
    &quot;Id&quot;: &quot;567&quot;,
    &quot;Application&quot;: &quot;TEST&quot;
  },
  {
    &quot;Timestamp&quot;: &quot;Mon Sep 01 13:19:42 CDT 2020&quot;,
    &quot;Id&quot;: &quot;567-test-00-10&quot;,
    &quot;Application&quot;: &quot;TEST&quot;
  },
  {
    &quot;Timestamp&quot;: &quot;Mon Sep 01 10:19:42 CDT 2020&quot;,
    &quot;Id&quot;: &quot;567-test-03-10&quot;,
    &quot;Application&quot;: &quot;TEST&quot;
  },
  {
    &quot;Timestamp&quot;: &quot;Mon Sep 01 15:19:42 CDT 2020&quot;,
    &quot;Id&quot;: &quot;567-test-01-10&quot;,
    &quot;Application&quot;: &quot;TEST&quot;
  },
  {
    &quot;Timestamp&quot;: &quot;Mon Sep 01 08:19:42 CDT 2020&quot;,
    &quot;Id&quot;: &quot;567-test-02-10&quot;,
    &quot;Application&quot;: &quot;TEST&quot;
  }
  </code></pre>
  <p>I need to get the latest and oldest timestamps to create the report and I am having difficulty grouping them by the id.</p>
  <p>My idea is to get the first part of the id and group them together but I not able to achieve this.</p>
  <p>I tried <code>basesearch |eval id= mvindex(split(id, &quot;-&quot;),0)  |stats last(Timestamp) as latestTime by id*</code> which isn't working.</p>
  <p>I need to show <code>id,late(Timestamp),first(Timestamp)</code> in the report. I would really appreciate any help</p>