How to group similar events into one event

[callumring]

Hi,

We have pulled logs from our Anti Virus software into splunk and are in process of trying to filter through what we actually want to track.

We want to track all events that relate to sites blocked for particular reasons EG:
'https://ads.converge-digital.com' blocked due to category 'Proxies & Translators'

We have a lot of different sites that are being blocked in the same way, so is there a way to group these all together so we can see everything that has been blocked by 'Proxies and Translators' as opposed to sifting through each individual event?

Thanks

[wmyersas]

You'll want to use |stats for this. Something like this:

index=ndx sourcetype=av domain=* blockedreason=*
| stats values(domain) as "Domains Blocked" by blockedreason
| rename blockedreason as "AV Policy Violation"

See https://docs.splunk.com/Documentation/Splunk/Latest/SearchReference/Stats for mroe details on what kinds of statistical functions you might want to use

[callumring]

So it seems as thought I can rename the title using this, but not the actual event that I want to group together.

It isnt the actual heading I want to rename and group, rather the list of all events that fall into that field. EG:
rename name='*' blocked due to category 'Advertisements & Pop-Ups' as "Blocked events - Advertisments and Pop Ups"
This will not work as it will not allow me to rename the whole event, just the heading (name) that it comes under.

[wmyersas]

I'm fairly certain the example I provided is still what you're describing: it'll group all the blocked domains by the reason they're blocked (of course, substitute actual field names vs the example)