https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86203#M21985 <P>Will you still be sending example data?</P> <P>So is there one line with taskid , duration, type. Then another line with Id and owner where the id will equal taskid?</P> Wed, 07 Mar 2012 00:50:36 GMT cramasta 2012-03-07T00:50:36Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86198#M21980 <P>I'm new to splunk, here's my issue. I have a log file which contains the extracted fields below:<BR /> task_id<BR /> task_duration<BR /> content_owner<BR /> task_type</P> <P>I'm looking to find the task_duration for two search strings "string ABC" OR "string 123" so those two lines which would return would have task_id, task_duration, and task_type. I need to use the task_id to find the content_owner as its elsewhere in the log... In the end what I want to see is:</P> <P>task_id: #### content_owner: XYZ task_type: XYZ task_duration: ####<BR /> task_type: ZYX task_duration: ####<BR /> </P>task_id: #### etc<P></P> Mon, 28 Sep 2020 11:29:16 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86198#M21980 tb582 2020-09-28T11:29:16Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86199#M21981 <P>Really would need to see your data to figure out the right solution but you could try something like</P> <P>...| transaction task_id</P> <P>OR</P> <P>....| stats values by task_id</P> Tue, 06 Mar 2012 22:23:07 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86199#M21981 cramasta 2012-03-06T22:23:07Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86200#M21982 <P>I tried that - doesnt seem to work exactly the way I want - can I send you some examples offline?</P> Tue, 06 Mar 2012 23:07:03 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86200#M21982 tb582 2012-03-06T23:07:03Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86201#M21983 <P>Sure send to <A href="mailto:j1621c@Yahoo.com">j1621c@Yahoo.com</A></P> Tue, 06 Mar 2012 23:11:10 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86201#M21983 cramasta 2012-03-06T23:11:10Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86202#M21984 <P>Actually looking at my data again, it looks like I was slightly off... Maybe you can help ne with a bit more detail. So I still want to see the data as above but I was wrong about content_owner its not contained within the same task_id but rather Splunk will need to look for owner based on an extracted field called id.</P> Mon, 28 Sep 2020 11:29:18 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86202#M21984 tb582 2020-09-28T11:29:18Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86203#M21985 <P>Will you still be sending example data?</P> <P>So is there one line with taskid , duration, type. Then another line with Id and owner where the id will equal taskid?</P> Wed, 07 Mar 2012 00:50:36 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86203#M21985 cramasta 2012-03-07T00:50:36Z https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86204#M21986 <P>ok logs sent</P> Wed, 07 Mar 2012 01:29:42 GMT https://community.splunk.com/t5/Splunk-Search/Join-or-something-better/m-p/86204#M21986 tb582 2012-03-07T01:29:42Z