topic Re: How to link 2 events without loosing data? in Splunk Search

How to link two events without loosing data?

keanderson — Tue, 08 Mar 2022 01:21:50 GMT

I am trying to link 2 events together due to information in the first event not showing in the second. the information is needed to filter the results. I have been trying to use transaction but in doing that I am loosing information needed to filter the end results-

eventA OR (eventB (amount>25 AND amount!=250 AND amount!="NONE")) |transaction blue |lookup C fieldD OUTPUT eggs |search eggs>21 |table fieldD amount eggs blue

that is the basics of the search, the problem is that fieldD is only in eventA, amount only in eventB. After using transaction to link them, amount disappears and can't be used to filter.

Is there any other way to link the 2 events without loosing data within the events?

Re: How to link 2 events without loosing data?

ITWhisperer — Fri, 04 Mar 2022 07:33:27 GMT

If they have a common value, e.g. transaction id, you can use stats by

| eventstats values(fieldD) as fieldD values(amount) as amount by transactionId

Re: How to link 2 events without loosing data?

keanderson — Mon, 07 Mar 2022 16:11:12 GMT

I think that would normally work but in this case it switched it so I was getting amount but not fieldD. I ended up using a lookup for an alternative. so far it is working. Thank you though! That is good information to know for other situations.