From a human standpoint, we realize that there are effectively two groups of data here in the "Serial" field. One starting with "1", and one starting with "9":
How do I leverage Splunk to spit out all of the values in the groups we know exist, organized together and displayed in front of me? I have over 6,000 unique "Serial" values probably making around 15 "groups", but I can't figure out how to get the data organized how I want.
I thought cluster command would work but it doesn't seem to display every unique value in the group, only the top hitter. Correct me if I'm wrong.
Any ideas welcome.
Ah thank you. I realize I left out a crucial part of the data set the makes a specific grouping impossible though. This is a more realistic set: