Splunk Search

Grouping events

Contributor

How do I develop a query that groups events by product names? I don't know what the product names are. But I need a query that will extract that data and group it.

I've tried using kmeans and transaction but I was not able to get the desired results. Thanks.

Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

index=* | stats count by productNames | sort -count

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

index=* | stats count by productNames | sort -count

View solution in original post

0 Karma

Legend

How do you mean "sort by"? Do you want to join disparate events into one event based on the productName? Or do you want to create statistics based on productName? It's much easier to answer if you can provide us with a clear and concise description of a specific goal you want to achieve, preferrably also with sample log events.

0 Karma

Contributor

For example, let's say I have products like sendmail, named, and httpd in my logs. These are under a field called productName. I want to be able to create a query that sorts by these productNames. Preferably without using the productNames in the query (but I will if I have to).

0 Karma

Builder

Can you give us an example of the data / events you are trying to group?

0 Karma