Answer by warren for Merge url with parameters into 1 in Splunk

You could try doing a replace() on your URL field with eval before calling stats:

| eval url=replace(url,"\/\d+\/settings","/settings")

If it turns out the userid is important to hold onto, pull it into its own field prior to running replace():

| rex field=url "\/(?<userid>\d+)\/settings"

from User warren – Stack Overflow https://stackoverflow.com/questions/71791315/merge-url-with-parameters-into-1-in-splunk/71798806#71798806
via IFTTT