Splunk Search

Cluster Command Based on Multiple Fields

michaelsplunk1
Path Finder

Can the cluster command cluster based on more than one field? I know we can change which field to cluster by, but can we cluster by multiple fields?

Labels (1)
Tags (1)
0 Karma
1 Solution

niketn
Legend

@michaelsplunk1  you can use eval to merge the fields together and then perform cluster on the combined field. Following is a run anywhere example based on Splunk's _internal index that merges log_level and component fields and performs cluster on the combined field.

index=_internal sourcetype=splunkd
| fields log_level component
| eval merge_field=log_level."|".component
| cluster field=merge_field showcount=t t=0.5
| sort - cluster_count
| eval merge_field=split(merge_field,"|"), log_level=mvindex(merge_field,0),component=mvindex(merge_field,1)
| table log_level component cluster_count

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

The documentation says

Syntax: field=<field>
Description: Name of the field to analyze in each event.
Default: _raw

The phrase "the field" implies only one field can be used.  For more than one field, try _raw

---
If this reply helps you, Karma would be appreciated.
0 Karma

niketn
Legend

@michaelsplunk1  you can use eval to merge the fields together and then perform cluster on the combined field. Following is a run anywhere example based on Splunk's _internal index that merges log_level and component fields and performs cluster on the combined field.

index=_internal sourcetype=splunkd
| fields log_level component
| eval merge_field=log_level."|".component
| cluster field=merge_field showcount=t t=0.5
| sort - cluster_count
| eval merge_field=split(merge_field,"|"), log_level=mvindex(merge_field,0),component=mvindex(merge_field,1)
| table log_level component cluster_count

 

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...