splunk - Get a distinct count of field values matching a regex

Question

I am doing this -

<<>> | search $country$ $campaign_name$ event_name=email OR event_name=event|stats dc(person_id)

Now in last instead of dc of person_id i need a count of person_id which matches a regex -

<<>> | search $country$ $campaign_name$ event_name=email OR event_name=event|stats dc(regex person_id="^(.?$|[^W].+|W[^F].*)" )

I tried above query using regex in dc() but it breaks. Any help would be greatly appreciated.

Answer 1

This is an old question, but for the benefit of anyone else who cares, this should give the expected results.

<<>> | search $country$ $campaign_name$ event_name=email OR event_name=event|stats dc(eval(match(person_id,"^(.?$|[^W].+|W[^F].*)")))