Hello, I am quite a new user of splunk and have a question.
Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?
Thanks
Your best bet is to use the punct
field which is the pattern of the event. You can read more about this field here: http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct
For example:
sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count