https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201200#M39789 <P>I would like to use the below transaction in Data Model<BR /> | transaction maxevents=2 keeporphans=true <BR /> what is the best way to do this? </P> Thu, 07 Sep 2017 05:38:09 GMT pranav_agile 2017-09-07T05:38:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201194#M39783 <P>Hello </P> <P>I have three different data sources (so 3 different types of events)</P> <P>DataSource_1: Event_Number Ticket<BR /> DataSource_2: Event_Number Create_Event_Date<BR /> DataSource_3: Ticket Create_Ticket_Date</P> <P>I would like to get one event which has: Ticket Create_Ticket_date Create_Event_Date</P> <P>Is it possible to build a search which shows this as one event, taking also into account possible new completely different data sources (e.g. DataSource_4)? </P> <P>I was trying transaction (not efficient), lookups (which I created from two different sources and use inputlookup populated to the 3rd one. In the search, there was some specification to those 3 data sources. Doing a lot of reports I would always need to take into account this part.</P> <P>Thank you</P> Tue, 29 Sep 2020 07:40:58 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201194#M39783 akawacz 2020-09-29T07:40:58Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201195#M39784 <P>What correlation fields do you have to link events between sources?</P> Tue, 27 Oct 2015 23:00:35 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201195#M39784 woodcock 2015-10-27T23:00:35Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201196#M39785 <P>You didn't mention how you tried to use transaction. I admit it's not the most efficient thing, but I've used it on fairly large datasets well if you can limit the time and events it's operating on.</P> <PRE><CODE>... | transaction Event_Number Ticket maxspan=15m maxpause=15m maxevents=3 </CODE></PRE> <P>If speed is still a problem, you could create a Data Model containing that information and accelerate it.</P> <P>That does assume Event_Number and Ticket aren't equal to one another within a 15 minute period, and obviously assuming they get generated within 15 minutes of each other. Adjust as necessary.</P> Wed, 28 Oct 2015 02:04:33 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201196#M39785 Richfez 2015-10-28T02:04:33Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201197#M39786 <P>just a funny thought; who about this:</P> <PRE><CODE> base search here | eval corr_field= coalesce(Event_Number, Ticket) | stats values(*) AS * by corr_field </CODE></PRE> Wed, 28 Oct 2015 02:43:44 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201197#M39786 MuS 2015-10-28T02:43:44Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201198#M39787 <P>Correlation is by the same column name</P> <P>So DataSouce_1 Event_Number = DataSource_2 Event_Number<BR /> DataSource_1 Ticket= DataSource_3 Ticket </P> Tue, 29 Sep 2020 07:43:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201198#M39787 akawacz 2020-09-29T07:43:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201199#M39788 <P>Try this:</P> <PRE><CODE>... | eventstats values(Ticket) AS Ticket BY Event_Number | eventstats values(Event_Number) AS Event_Number BY Ticket | stats values(*) AS * by Ticket </CODE></PRE> Thu, 29 Oct 2015 16:59:30 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201199#M39788 woodcock 2015-10-29T16:59:30Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201200#M39789 <P>I would like to use the below transaction in Data Model<BR /> | transaction maxevents=2 keeporphans=true <BR /> what is the best way to do this? </P> Thu, 07 Sep 2017 05:38:09 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201200#M39789 pranav_agile 2017-09-07T05:38:09Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201201#M39790 <P>Avoid <CODE>transaction</CODE> like the plague that it is. It should only be used for transitive key mapping (e.g. some events have <CODE>EmployeeID</CODE>, others have <CODE>Address</CODE>, others have <CODE>loginID</CODE> and each of this is fully unique to a single individual. Then the best way to link is to use <CODE>| transaction EmployeeID Address loginID</CODE>. Otherwise do yourself a favor and do not ever use it; it does not scale.</P> Sat, 09 Sep 2017 19:51:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201201#M39790 woodcock 2017-09-09T19:51:27Z https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201202#M39791 <P>Sure, thanks Woodcock. </P> Tue, 12 Sep 2017 04:18:00 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-combine-different-types-of-events-from-different-data/m-p/201202#M39791 pranav_agile 2017-09-12T04:18:00Z