Grouping events

[DTERM]

How do I develop a query that groups events by product names? I don't know what the product names are. But I need a query that will extract that data and group it.

I've tried using kmeans and transaction but I was not able to get the desired results. Thanks.

[mzorzi · Accepted solution]

index=* | stats count by productNames | sort -count

[Ayn]

How do you mean "sort by"? Do you want to join disparate events into one event based on the productName? Or do you want to create statistics based on productName? It's much easier to answer if you can provide us with a clear and concise description of a specific goal you want to achieve, preferrably also with sample log events.

[DTERM]

For example, let's say I have products like sendmail, named, and httpd in my logs. These are under a field called productName. I want to be able to create a query that sorts by these productNames. Preferably without using the productNames in the query (but I will if I have to).

[Brian_Osburn]

Can you give us an example of the data / events you are trying to group?