https://community.splunk.com/t5/Deployment-Architecture/Cluster-Command-Grouping/m-p/494694#M17062 <P>Hi,</P> <P>Need help on below issue. I am using cluster command for Summary field.</P> <P>source="sample_data.csv" index="incidents" sourcetype="csv" | makemv Summary | mvexpand Summary| top limit=500 Summary | eval Summary=replace(Summary,"([\,+])","")|regex Summary = "[a-zA-Z0-9]"|search NOT [ |inputlookup Stop_Words.csv | rename Word as Summary ] | cluster t=0.6 showcount=t field=Summary|table cluster_count cluster_label Summary | sort -cluster_count</P> <P>below are the results</P> <P>cluster_count cluster_label Summary<BR /> 5 107 page<BR /> 3 10 check<BR /> 3 28 unavailable<BR /> 3 41 error<BR /> 3 54 tool<BR /> 3 62 issue<BR /> 3 64 details</P> <P>Different words are grouped together. I am expecting like below</P> <P>Job - {Job,Jobs,Job?,Job!}<BR /> Error - {Issue,Error}</P> <P>How can i do that? How can i grouped the similar words together and categorize.</P> <P>Appreciate for quick help</P> Wed, 30 Sep 2020 03:09:52 GMT lavanya_gurrapu 2020-09-30T03:09:52Z https://community.splunk.com/t5/Deployment-Architecture/Cluster-Command-Grouping/m-p/494694#M17062 <P>Hi,</P> <P>Need help on below issue. I am using cluster command for Summary field.</P> <P>source="sample_data.csv" index="incidents" sourcetype="csv" | makemv Summary | mvexpand Summary| top limit=500 Summary | eval Summary=replace(Summary,"([\,+])","")|regex Summary = "[a-zA-Z0-9]"|search NOT [ |inputlookup Stop_Words.csv | rename Word as Summary ] | cluster t=0.6 showcount=t field=Summary|table cluster_count cluster_label Summary | sort -cluster_count</P> <P>below are the results</P> <P>cluster_count cluster_label Summary<BR /> 5 107 page<BR /> 3 10 check<BR /> 3 28 unavailable<BR /> 3 41 error<BR /> 3 54 tool<BR /> 3 62 issue<BR /> 3 64 details</P> <P>Different words are grouped together. I am expecting like below</P> <P>Job - {Job,Jobs,Job?,Job!}<BR /> Error - {Issue,Error}</P> <P>How can i do that? How can i grouped the similar words together and categorize.</P> <P>Appreciate for quick help</P> Wed, 30 Sep 2020 03:09:52 GMT https://community.splunk.com/t5/Deployment-Architecture/Cluster-Command-Grouping/m-p/494694#M17062 lavanya_gurrapu 2020-09-30T03:09:52Z