topic Re: Copy field to another event in Splunk Search

Copy field to another event

mihirpradhan — Wed, 30 Sep 2020 05:09:55 GMT

Hello,

I'm searching doing a search in splunk for the "request_id" field. For example: request_id = "XXXXXXX"
It returns data from 2 sources. I can do a dedup and get the last event and it has everything I need except for the duration field. Is there a way I can pass the duration field and the value to another event before running dedup?

If yes, how can I do this in bulk? I have a subsearch with a table of request_id's. I use it to search for all events matching those request_id's. How can I make sure that for each individual request_id, the duration field is populated for all events?

Thanks

Re: Copy field to another event

to4kawa — Wed, 29 Apr 2020 03:52:42 GMT

yes, use stats range

Re: Copy field to another event

DavidHourani — Wed, 29 Apr 2020 05:53:01 GMT

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

Re: Copy field to another event

mihirpradhan — Thu, 30 Apr 2020 02:19:45 GMT

That worked perfect.

stats latest(*) as * by request_id is exactly what I was looking for!

Re: Copy field to another event

DavidHourani — Thu, 30 Apr 2020 07:16:53 GMT

Awesome, glad I could help ! 🙂