topic Merging data from multiple events into a single field in Reporting

Merging data from multiple events into a single field

tchmielarski — Mon, 28 Sep 2020 09:30:07 GMT

I want to merge data from multiple splunk events into a single field value - does anyone know how?
As an example, lets say we have antivirus data events which contain host name and the virus name. I can do a search to return all of the signatures for a specific host. My goal is to merge those signatures.

where the raw records (simplified) might be:
system_1, virus_a
system_1, virus_b
system_1, virus_c
system_2, virus_b

I want my output to be:
dest=system_1, infections="virus_a, virus_b, virus_c"

Re: Merging data from multiple events into a single field

thinman — Wed, 27 Apr 2011 18:53:09 GMT

Hi,

look for the transaction command basically adding to you search line:
" | transaction dest "

Don´t forget to include the pipe

Look on: Transaction definition

By the way don't forget to tag your fields!

Re: Merging data from multiple events into a single field

tchmielarski — Wed, 27 Apr 2011 20:40:59 GMT

the answer appears to be |transaction (thanks) plus |mvcombine
The delimiter (delim=",") does not show up, and i'm still working on that so the result is more legible but the current result is more or less what I wanted.

example:
.... |transaction dest_host maxspan=7d maxpause=7d | mvcombine delim="," signature