Getting Data In

Similar events

Engager

Hello, I am quite a new user of splunk and have a question.

Is there any way of having splunk to match data that is somewhat similar? What I would like to do is to have a summary count of all syslog events, they can contain different data (host names, user names, addresses). Do I have to try to find fields and use them or is there any easier way?

Thanks

Tags (1)

Influencer

Your best bet is to use the punct field which is the pattern of the event. You can read more about this field here: http://www.splunk.com/base/Documentation/4.2.2/User/UseDefaultAndInternalFields#punct

For example:

sourcetype=syslog | stats count first(_raw) as event by punct | table count event | sort -count