The LogReduce algorithm uses fuzzy logic to cluster messages together based on string and pattern similarity. You can use the logreduce operator to quickly assess activity patterns for things like a range of devices or traffic on a website. Focus the LogReduce algorithm on an area of interest by defining that area in the keyword expression.
When you've already run a search query with non-aggregate results, you can use the LogReduce button in the Messages tab to automatically apply the LogReduce operator to the current results.
To use LogReduce:
- Run a search query with non-aggregate results.
- In the Messages tab, the LogReduce button displays. Click it to automatically apply the LogReduce operator to your results.
- The Signatures tab is displayed with your results.
For information on how to interpret and influence the outcome of LogReduce results, see Detecting Patterns with LogReduce and Influencing the LogReduce Outcome.