topic Can I sort log event patterns by their source types? in Splunk Search

Can I sort log event patterns by their source types?

alanzchan — Fri, 16 Nov 2018 20:09:10 GMT

I am trying to identify which source types produce data with the same log format. Currently, I am using this query to show the highest percentage log pattern for access logs in my domain:

sourcetype=*access*| cluster t=.7 labelonly=t | findkeywords labelfield=cluster_label | table sampleEvent percentInInputGroup| sort - percentInInputGroup  |top limit=10 percentInInputGroup

How do I show which source types are being used to produce logs in that pattern group?

Am I approaching this the correct way?

Re: Can I sort log event patterns by their source types?

kmorris_splunk — Sat, 17 Nov 2018 20:37:11 GMT

Try using the punct field. This pulls out all of the punctuation in an event, which can be helpful in identifying similar events.

Re: Can I sort log event patterns by their source types?

adonio — Sun, 18 Nov 2018 01:29:26 GMT

@kmorris comment is spot on imho.
you can start like that for example:
| tstats count as event_count where index=* sourcetype=*access* by punct sourcetype

hope it helps