https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58425#M14298 <P>How do you mean "sort by"? Do you want to join disparate events into one event based on the productName? Or do you want to create statistics based on productName? It's much easier to answer if you can provide us with a clear and concise description of a specific goal you want to achieve, preferrably also with sample log events.</P> Tue, 16 Aug 2011 14:31:17 GMT Ayn 2011-08-16T14:31:17Z https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58422#M14295 <P>How do I develop a query that groups events by product names? I don't know what the product names are. But I need a query that will extract that data and group it. </P> <P>I've tried using kmeans and transaction but I was not able to get the desired results. Thanks.</P> Mon, 15 Aug 2011 22:10:25 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58422#M14295 DTERM 2011-08-15T22:10:25Z https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58423#M14296 <P>Can you give us an example of the data / events you are trying to group?</P> Mon, 15 Aug 2011 22:16:40 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58423#M14296 Brian_Osburn 2011-08-15T22:16:40Z https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58424#M14297 <P>For example, let's say I have products like sendmail, named, and httpd in my logs. These are under a field called productName. I want to be able to create a query that sorts by these productNames. Preferably without using the productNames in the query (but I will if I have to).</P> Tue, 16 Aug 2011 14:18:58 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58424#M14297 DTERM 2011-08-16T14:18:58Z https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58425#M14298 <P>How do you mean "sort by"? Do you want to join disparate events into one event based on the productName? Or do you want to create statistics based on productName? It's much easier to answer if you can provide us with a clear and concise description of a specific goal you want to achieve, preferrably also with sample log events.</P> Tue, 16 Aug 2011 14:31:17 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58425#M14298 Ayn 2011-08-16T14:31:17Z https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58426#M14299 <P>index=* | stats count by productNames | sort -count</P> Tue, 16 Aug 2011 23:52:15 GMT https://community.splunk.com/t5/Splunk-Search/Grouping-events/m-p/58426#M14299 mzorzi 2011-08-16T23:52:15Z