https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517187#M145407 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225651">@Khuzair81</a>&nbsp;, is there a common value between these two events, like how would you decide to merge these events, is this based on timestamps ? Also, you are trying to do this during search time right ?</P> Tue, 01 Sep 2020 08:33:27 GMT Nisha18789 2020-09-01T08:33:27Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517106#M145376 <P>Event1 - Ticket_no = username*, id=111 Event2 - Ticket_no = TKT123, Id =0 Is there any way to merge this 2 events to get stats as : Ticket_no= TKT123, id=111</P> Mon, 31 Aug 2020 23:36:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517106#M145376 Khuzair81 2020-08-31T23:36:55Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517123#M145384 How would Splunk know how to merge those events? They must have something in common and the example events do not. Mon, 31 Aug 2020 21:03:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517123#M145384 richgalloway 2020-08-31T21:03:06Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517187#M145407 <P>hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/225651">@Khuzair81</a>&nbsp;, is there a common value between these two events, like how would you decide to merge these events, is this based on timestamps ? Also, you are trying to do this during search time right ?</P> Tue, 01 Sep 2020 08:33:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517187#M145407 Nisha18789 2020-09-01T08:33:27Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517447#M145506 <P>Hi <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a></P><P>There is one thing common in both event but the column name is different.&nbsp;</P><P>Event1 : Ticket_no - username123,</P><P>Event2 : Ticket_no. - TKT123, UserId - username123</P> Wed, 02 Sep 2020 09:43:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517447#M145506 Khuzair81 2020-09-02T09:43:41Z https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517473#M145514 <P>Try this.</P><LI-CODE lang="markup">&lt;your base search&gt; | eval username=coalesce(UserId, Ticket_no) | stats values(*) as * by username</LI-CODE> Wed, 02 Sep 2020 12:59:15 GMT https://community.splunk.com/t5/Splunk-Search/How-to-merge-two-events/m-p/517473#M145514 richgalloway 2020-09-02T12:59:15Z