https://community.splunk.com/t5/Getting-Data-In/Similar-events/m-p/28770#M4948 <P>Hello, I am quite a new user of splunk and have a question.</P> <P>Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?</P> <P>Thanks</P> Wed, 15 Jun 2011 20:08:45 GMT Henkis 2011-06-15T20:08:45Z https://community.splunk.com/t5/Getting-Data-In/Similar-events/m-p/28770#M4948 <P>Hello, I am quite a new user of splunk and have a question.</P> <P>Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?</P> <P>Thanks</P> Wed, 15 Jun 2011 20:08:45 GMT https://community.splunk.com/t5/Getting-Data-In/Similar-events/m-p/28770#M4948 Henkis 2011-06-15T20:08:45Z https://community.splunk.com/t5/Getting-Data-In/Similar-events/m-p/28771#M4949 <P>Your best bet is to use the <CODE>punct</CODE> field which is the pattern of the event. You can read more about this field here: <A href="http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct">http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct</A></P> <P>For example: </P> <PRE><CODE>sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count </CODE></PRE> Wed, 15 Jun 2011 22:30:30 GMT https://community.splunk.com/t5/Getting-Data-In/Similar-events/m-p/28771#M4949 ziegfried 2011-06-15T22:30:30Z