The cluster command provides a method to cluster similar events together, making it easier for you to identify outliers. Outliers are those events that are part of very small clusters or are on their own; all other events are a part of large-sized clusters. In the following example, we use the cluster command against the website access logs to identify any potential outlier. The showercount parameter is used to ensure the size of each cluster displayed. The table and sort commands are just to make data presentation a little bit nicer:
index=main sourcetype=access_combined | cluster showcount=t | table cluster_count _raw | sort +cluster_count
The results that are returned will be sorted with the smallest cluster being ...
