https://community.splunk.com/t5/Getting-Data-In/Unified-log-how-to/m-p/339055#M62564 <P>Hi,</P> <P>You can do that with <CODE>transaction</CODE> command. Also refer documents for it:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction</A></P> Mon, 12 Mar 2018 13:01:48 GMT p_gurav 2018-03-12T13:01:48Z https://community.splunk.com/t5/Getting-Data-In/Unified-log-how-to/m-p/339054#M62563 <P>Hi,</P> <P>I would like to know if there is option to unify logs based on id or something else.</P> <P><STRONG>For example:</STRONG><BR /> I have the initial log and after 15 sec, I get an update for that log (not necessarily sequential).</P> <P>Is there any option to merge them into 1 log (instead of 2) and doing it before indexing (since I want to index 1 log)?</P> <P>Thanks,<BR /> Shay</P> Mon, 12 Mar 2018 09:35:29 GMT https://community.splunk.com/t5/Getting-Data-In/Unified-log-how-to/m-p/339054#M62563 shayhibah 2018-03-12T09:35:29Z https://community.splunk.com/t5/Getting-Data-In/Unified-log-how-to/m-p/339055#M62564 <P>Hi,</P> <P>You can do that with <CODE>transaction</CODE> command. Also refer documents for it:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction">https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction</A></P> Mon, 12 Mar 2018 13:01:48 GMT https://community.splunk.com/t5/Getting-Data-In/Unified-log-how-to/m-p/339055#M62564 p_gurav 2018-03-12T13:01:48Z