multiple search question

[a212830]

Hi,

I want to create a report on syslog messages received from the same file, which come from different types of devices, with different formats (Cisco, HP, Arista, Brocade). I can't route the messages to different files. Is there a way to do a single search that will show the number of "message types", even if the format is different?

For example:

Cisco: %CDP-4-DUPLEX_MISMATCH:
HP: %%10MSTP/1/PFWD(t):
Arista: : %LINEPROTO-5-UPDOWN:
Brocade: VRRP-Extended:

Each of these are message types that I want to report on, and they exist in the same file. I don't think a single regex would capture them all, so is there another option?

[melonman]

You can use eventtype.
First you need to create eventtype for each event - Cisco, HP, Arista and Brocate,
and then, search and count for each eventtype like this:

... | stats count by eventtype

http://docs.splunk.com/Documentation/Splunk/5.0.1/Knowledge/ClassifyAndGroupSimilarEvents