topic Cluster Command Based on Multiple Fields in Splunk Search

Cluster Command Based on Multiple Fields

michaelsplunk1 — Mon, 13 Jul 2020 16:19:21 GMT

Can the cluster command cluster based on more than one field? I know we can change which field to cluster by, but can we cluster by multiple fields?

Re: Cluster Command Based on Multiple Fields

niketn — Mon, 13 Jul 2020 17:42:26 GMT

@michaelsplunk1 you can use eval to merge the fields together and then perform cluster on the combined field. Following is a run anywhere example based on Splunk's _internal index that merges log_level and component fields and performs cluster on the combined field.

Re: Cluster Command Based on Multiple Fields

richgalloway — Mon, 13 Jul 2020 17:48:21 GMT

The documentation says

Syntax: field=<field> Description: Name of the field to analyze in each event. Default: _raw

The phrase "the field" implies only one field can be used. For more than one field, try _raw.