Deployment Architecture

How do I group similar values in fields throughout all events together?

thisissplunk
Builder

From a human standpoint, we realize that there are effectively two groups of data here in the "Serial" field. One starting with "1", and one starting with "9":

  • Serial=123456789
  • Serial=123456788
  • Serial=123456787
  • Serial=987654321
  • Serial=987654322
  • Serial=987654323

How do I leverage Splunk to spit out all of the values in the groups we know exist, organized together and displayed in front of me? I have over 6,000 unique "Serial" values probably making around 15 "groups", but I can't figure out how to get the data organized how I want.

I thought cluster command would work but it doesn't seem to display every unique value in the group, only the top hitter. Correct me if I'm wrong.

  • index=stuff Serial="*" | cluster t=0.35 field=Serial | stats values(Serial) by cluster_label

Any ideas welcome.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How about this

index=stuff Serial="*" | stats count by Serial | eval Group=substr(Serial,1,5) | stats values(Serial) by Group

thisissplunk
Builder

The rhyme or reason as to why serial is created with certain patterns is unknown to us, but we want to figure it out. We are working backwards here.

0 Karma

thisissplunk
Builder

So the problem is that is impossible, and why I want to use the cluster command if possible. I need fancy math to relate things together for me.

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You would have to define the pattern using which you can group Serials. Based on your fixed pattern you change the query.

0 Karma

thisissplunk
Builder

Ah thank you. I realize I left out a crucial part of the data set the makes a specific grouping impossible though. This is a more realistic set:

  • Serial=102312-6789
  • Serial=102315-6389
  • Serial=102322-6787
  • Serial=028765-4321
  • Serial=328765-4331
  • Serial=918765-4391
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...