How do i find the most common events in my search?

[RicoSuave]

As a splunk user, i want to find the most common events in my search results. How would I accomplish this? I am trying to determine what are the top 5 or 10 most common log messages coming into splunk.

[RicoSuave · Accepted solution]

This should do the trick

| cluster | table cluster_count, _raw | sort - cluster_count

Reference the docs for the cluster command here: http://docs.splunk.com/Documentation/Splunk/4.3.2/SearchReference/Cluster

[jwelsh_splunk]

Please note to get the table to show the count properly your search should include showcount=t, or:

| cluster showcount=t| table cluster_count, _raw | sort - cluster_count