Group events based on the field value

[tgdvopab]

Hello, I want to count the number of different messages and show them in a pie chart.
My data looks like the following:

Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b59c'. | 2
An error occurred while trying to unsubscribe service with Subscription ID '309928f2-9ba9-43ee-b50d-367d1764b39c'. | 3
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain='test' | 1
CreateDomainConfiguration - domain='test' | 3
CreateDomainConfiguration - domain='test' | 6
Could not contact master for new replication information | 2

Now I want to group similar events based on the field value like this:

Message | Count
An error occurred while trying to get domainconfigurations | 15
An error occurred while trying to unsubscribe service with Subscription ID | 5
Error occurred: System.Threading.Tasks.TaskCanceledException: A task was canceled. | 12
CreateDomainConfiguration - domain | 10
Could not contact master for new replication information | 2

How can I achieve this? Thanks a lot!

[somesoni2]

You may want to look at the cluster command in Splunk which "groups events together based on how similar they are to each other". See more details here.

https://docs.splunk.com/Documentation/Splunk/6.5.0/SearchReference/Cluster
http://blogs.splunk.com/2014/07/28/splunk-command-cluster/

[richgalloway · Accepted solution]

This has worked for me.

...  | eval Message=case(like(Message,"An error occurred while trying to unsubscribe service with Subscription ID%"), "An error occurred while trying to unsubscribe service with Subscription ID", like(Message, "CreateDomainConfiguration - domain%"),"CreateDomainConfiguration - domain", 1=1,Message)| stats sum(Count) as Count by Message | table Message Count