punct is a field just like any other. The content is punct is the same as the event stripping all letters and number, and replacing whitespace with the underscore. Leaving just the PUNCTuation.
punct is useful for finding similar messages that have varying some varying text in them. Process ids, host names, and times could be different in the content of several events, but the actual message that you care about could be the same. In may cases like this the punct will be the same across those events.
... View more