topic Re: How to add field from different event for data model purpose in Splunk Search

How to add field from different event for data model purpose

armahalma — Wed, 12 Jan 2022 09:05:05 GMT

Is there a way to add a field to an event from a different event assuming they have a common key using a simple search (without using pipe)? The reason being the resulting event will need to be tagged via event type (which doesn't allow complex search) so it can be included as part of a data model.

For example,

Event 1 - field A (common key): ABC, field B: Sunny

Event 2 - field A (common key): ABC, field C: Morning

Resulting Event 1: field A: ABC, field B: Sunny, field C: Morning

The final event will then be tagged so it can be included in the data model.

Appreciate any advice/suggestion.

Re: How to add field from different event for data model purpose

isoutamo — Wed, 12 Jan 2022 10:14:18 GMT

have you already try

... | stats values(*) as * by field_A

r. Ismo

Re: How to add field from different event for data model purpose

armahalma — Mon, 17 Jan 2022 23:06:09 GMT

Thanks, but as mentioned I could not use pipe char "|" as part of the search as it's limited by the eventtype definition. https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Eventtypesconf

Using "transaction" does provide the field I need as it groups the related events, but I need the field from the second event to be there on the first event permanently so when we do search it would appear as part of the result - so I can't really use "transaction" in this case.

Ideally the two events should have been ingested as a single event so we won't have this problem, but that's not the case.

Re: How to add field from different event for data model purpose

isoutamo — Tue, 18 Jan 2022 07:39:19 GMT

If I understood your needs right you need to combine fields from two different events to one event?

If so you definitely needs some commands which can do that "merge" from 2 to 1. I cannot (quickly) figure out any other ways than use | as a part of this merge.

Can you open little bit more about your use case if there is some other way to do it than what you have thinking (create data model).

r. Ismo