Splunk Search

Fuzzy Search

tb5821
Communicator

I have a field called 'err_msg' this field contains a long line which consists of the error as well as the file name and other details surrounding that error. What I'm looking for is the ability to do a 'fuzzy' search in splunk on err_msg so that it will lump similar errors together. Is this possible?

Tags (1)
0 Karma
1 Solution

lpolo
Motivator

Did you try the cluster search command?

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Cluster

See also:

anomalies, anomalousvalue, kmeans, outlier

It might help you.

View solution in original post

lpolo
Motivator

Did you try the cluster search command?

http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Cluster

See also:

anomalies, anomalousvalue, kmeans, outlier

It might help you.

tb5821
Communicator

Thanks looks like cluster will do the trick!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...