topic Re: Join data inside same logs in Splunk Search https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150674#M42223 <P>You can use the transaction command.</P> <P>Your search | transaction startswith="login_id='loginA'" endswith="Whatever the last bit of it is"</P> <P>This will join the string together as one event.</P> Fri, 03 Oct 2014 09:42:09 GMT markthompson 2014-10-03T09:42:09Z Join data inside same logs https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150673#M42222 <P>I have logs with three fields (1) session_id, (2) login_id, (3) message<BR /> - session_id is "key"<BR /> - login_id is empty except user first login<BR /> e.g.<BR /> session_id,login_id,message<BR /> session1, loginA, message1<BR /> session1,, message2<BR /> session1,, message3<BR /> session2,loginB, message4</P> <P>How to join the data to retrieve all events and fields of "sesion1" only using login_id="loginA"?</P> Mon, 28 Sep 2020 17:47:30 GMT https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150673#M42222 tung62 2020-09-28T17:47:30Z Re: Join data inside same logs https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150674#M42223 <P>You can use the transaction command.</P> <P>Your search | transaction startswith="login_id='loginA'" endswith="Whatever the last bit of it is"</P> <P>This will join the string together as one event.</P> Fri, 03 Oct 2014 09:42:09 GMT https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150674#M42223 markthompson 2014-10-03T09:42:09Z Re: Join data inside same logs https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150675#M42224 <P>The transaction command will merge contents into a single row. But I want the result is shown as below table format. Can do it?</P> <P>time,session1,loginA,message1<BR /> time,session1,loginA,message2<BR /> time,session1,loginA,message3</P> Mon, 13 Oct 2014 06:18:01 GMT https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150675#M42224 tung62 2014-10-13T06:18:01Z Re: Join data inside same logs https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150676#M42225 <P>If you want to display it as a table, simply use the table command.</P> Wed, 18 Feb 2015 09:23:44 GMT https://community.splunk.com/t5/Splunk-Search/Join-data-inside-same-logs/m-p/150676#M42225 markthompson 2015-02-18T09:23:44Z