topic Re: Can someone suggest few ways of correlation of two or more fields in Splunk Search

Can someone suggest few ways of correlation of two or more fields

asm_coe — Tue, 28 May 2019 10:10:04 GMT

I have a ticket dump with following fields.
Transaction ID
Transaction Type
Description
Priority
urgency
Created On

Created By
Actual Closed
Resolution code
SR Type
App ID

My need to correlate among 2 fields. Please do provide few correlation search commands(SPL) with above fields. Also need to convert the search into dashboards.

Re: Can someone suggest few ways of correlation of two or more fields

koshyk — Tue, 28 May 2019 10:24:02 GMT

You can do co-relation in multiple ways

If each event contains all the fields => index=yourIndex sourcetype=yourSourceType Priority>2 Transaction_ID="12345"
If you want to club multiple events, then do transaction command

Please do read about converting searches to Dashboard
1. Build basic dashboard => http://dev.splunk.com/view/webframework-tutorials/SP-CAAAEN4
2. https://docs.splunk.com/Documentation/Splunk/latest/SearchTutorial/Createnewdashboard

Re: Can someone suggest few ways of correlation of two or more fields

DavidHourani — Tue, 28 May 2019 10:27:22 GMT

Hi @asm_coe,

Correlation takes place usually between multiple sources with similar fields. I think you're looking for building transactions. For that you can use the transaction command.

Your SPL would look like this :

index= yourIndex sourcetype=yourSourcetype | transaction Transaction_ID App_ID

This will combine all fields with similar transaction ID and APP ID together.

Official documentation here for the latest version:
https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Transaction

Let me know if that helps.

Cheers,
David

Re: Can someone suggest few ways of correlation of two or more fields

asm_coe — Tue, 28 May 2019 10:59:35 GMT

Thanks David for the quick help, Also please how can I convert this search into a dashboard. like chart or pie chart.

Re: Can someone suggest few ways of correlation of two or more fields

asm_coe — Tue, 28 May 2019 11:00:50 GMT

Thanks Koshyk, Can you please suggest few correlation commands.

Re: Can someone suggest few ways of correlation of two or more fields

DavidHourani — Tue, 28 May 2019 11:01:59 GMT

Ah, that's the easy part ^^ After running the search right next to the search button there is a "save as" button. Click that, select dashboard panel and then select either to make a new dashboard or an existing one.
If you need some documentation about that let me know !

Re: Can someone suggest few ways of correlation of two or more fields

asm_coe — Tue, 28 May 2019 11:11:40 GMT

Thanks David for your help. Really appreciated.

Re: Can someone suggest few ways of correlation of two or more fields

DavidHourani — Tue, 28 May 2019 11:16:34 GMT

Most welcome ! Please upvote and accept the answer if it was helpful 🙂