topic extracted field propagation across related events in Splunk Search

extracted field propagation across related events

twistedsixty4 — Mon, 28 Sep 2020 17:10:27 GMT

Hey all,
I have a event log that i have to generate reports off of for the BI team where i work. the problem i keep running into is that the different event types log different set of information all tied to a unique event_id, but i need to have one field of a specific event type tied to all the other events with the same id.

example:
time event_id Node user status event_type
18534564.56 05178 HIL-DEV01 not_reporting alert
18640234.9 05179 ROV-HOST01 disk_space_low alert
19538754.13 05178 Hal9001 closed

in this example i want to assign node HIL-DEV01 across all events with the ID of 05178. I have tried to do this with transactions, but i have found that i lose unique time values for events inside the transaction.

is it possible to do this with eval? or does anyone have an idea of what to do? if you need more info just let me know.

Re: extracted field propagation across related events

strive — Mon, 28 Sep 2020 17:10:30 GMT

Try this and see if this is hat you need

Some Search Terms | stats values(time) as Timers first(Node) as Node values(status) as Statuses values(event_type) as Events by event_id

Re: extracted field propagation across related events

somesoni2 — Thu, 24 Jul 2014 18:57:38 GMT

Give this a try

your base search | eventstats first(Node) as Node by event_id

Re: extracted field propagation across related events

twistedsixty4 — Thu, 24 Jul 2014 20:52:00 GMT

you are a godsend sir, this worked great!