Getting Data In

Similar events

Henkis
Engager

Hello, I am quite a new user of splunk and have a question.

Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?

Thanks

Tags (1)

ziegfried
Influencer

Your best bet is to use the punct field which is the pattern of the event. You can read more about this field here: http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct

For example:

sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...