https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151406#M42428 <P>I have a transaction search that works great. The table that it produces is useful but i want to append/augment it with additional data that I am inserting into Splunk about these "jobId"s via the API.</P> <PRE><CODE> jobId=* source="/logs/*" | transaction jobId startswith=QUEUED endswith=COMPLETED | table _time jobId duration </CODE></PRE> <P>I can search for the additional data via this search. Returns information about the jobID such as video_width, video_height, etc.</P> <PRE><CODE>source="augmentData-VideoId" jobId=3703a4e7cc51ac54 | table video_width video_height </CODE></PRE> <P>I am having trouble on how to get the additional data into the first search without affecting the transaction duration time since these additional data events are added via a cron job way after that transaction is completed.</P> Mon, 28 Sep 2020 15:20:28 GMT garland_tout 2020-09-28T15:20:28Z https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151406#M42428 <P>I have a transaction search that works great. The table that it produces is useful but i want to append/augment it with additional data that I am inserting into Splunk about these "jobId"s via the API.</P> <PRE><CODE> jobId=* source="/logs/*" | transaction jobId startswith=QUEUED endswith=COMPLETED | table _time jobId duration </CODE></PRE> <P>I can search for the additional data via this search. Returns information about the jobID such as video_width, video_height, etc.</P> <PRE><CODE>source="augmentData-VideoId" jobId=3703a4e7cc51ac54 | table video_width video_height </CODE></PRE> <P>I am having trouble on how to get the additional data into the first search without affecting the transaction duration time since these additional data events are added via a cron job way after that transaction is completed.</P> Mon, 28 Sep 2020 15:20:28 GMT https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151406#M42428 garland_tout 2020-09-28T15:20:28Z https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151407#M42429 <P>Try following:</P> <PRE><CODE>jobId=* source="/logs/*" | transaction jobId startswith=QUEUED endswith=COMPLETED | table _time jobId duration | join jobId [search source="augmentData-VideoId" | stats count by jobId, video_width, video_height | field - count] </CODE></PRE> <P>OR</P> <PRE><CODE>jobId=* source="/logs/*" | transaction jobId startswith=QUEUED endswith=COMPLETED | table _time jobId duration | join jobId [search source="augmentData-VideoId" | fields jobId, video_width, video_height | dedup jobId, video_width, video_height] </CODE></PRE> <P>final output- _time,jobId,duration,video_width,video_height</P> Mon, 28 Sep 2020 15:20:31 GMT https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151407#M42429 somesoni2 2020-09-28T15:20:31Z https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151408#M42430 <P>The first one works well. Did exactly want i wanted. Thanks!</P> Thu, 21 Nov 2013 21:39:15 GMT https://community.splunk.com/t5/Splunk-Search/Append-data-to-a-transaction/m-p/151408#M42430 garland_tout 2013-11-21T21:39:15Z