Hi. I have an excel dump of incident tickets generated from the ticketing tool. Sample incidents' description from the report: "Target: CI-xxxx Stateless event alarm Event details: HA recovered from a total cluster failure in cluster" "Server - CI-aaaa generates Multipath Issue Fibre Channel information: Multipathing ERROR, not all luns have 4 paths" "Servers generate CI-aaaa & CI-bbbbb - Multipath issue Fibre Channel information: Multipathing ERROR, not all luns have 4 paths" "Servers generate CI-aaaa & CI-bbbbb - Multipath issue Fibre Channel information: Multipathing ERROR, not all luns have 4 paths" "[VMware vCenter - Alarm Cluster high availability error] Insufficient resources to satisfy HA failover level on cluster" "F drive is having less disk space nagios-ebs: CI-xxxx " "Low disk space alert on CI-yyyyy" "Failed backup report for 2nd April 2012 : CI-xxxx , CI-aaaa , CI-bbbbb" "Failed backup report for 3rd April 2012 : CI-xxxx , CI-aaaa , CI-bbbbb" There is no exclusive "category" field. My end objective is to perform a Trend Analysis to identify top recurring issues. I could perform a grouping by going through the description fields one by one and identifying the incident type. Desired output would be : category ---- count of occurrence HA ---- 2 Multipath ---- 3 disk space ---- 2 failed backup ---- 2 The manual grouping would not be feasible though for a list of 300+ incidents. I was wondering if Splunk could identify the common significant text from the description fields and return a similar grouping, without the need to key in search strings ? ... View more