Getting Data In

Similar events


Hello, I am quite a new user of splunk and have a question.

Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?


Tags (1)


Your best bet is to use the punct field which is the pattern of the event. You can read more about this field here:

For example:

sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!