topic Re: join two fields from same source in Splunk Search

join two fields from same source

gudavasr — Tue, 19 May 2015 23:06:56 GMT

I have log file like this:

 deal - 123456 - notification receives from web  -- Time 10:46:42
 deal - 123456 - publishing xml    -- Time 10:46:43
 deal - 789012 - notification receives from web  -- Time 10:46:45
 deal - 123456 - SAVED ack  -- Time 10:46:46
 deal - 123456 - publishing xml  -- Time 10:46:49
 deal - 789012 - SAVED ack  -- Time 10:46:52
 deal - 123456 - SAVED ack  -- Time 10:46:58

I want to create field called deal id (for ex: 123456) and grab first line and create a field called dealcreatedtime (Time 10:46:42)
Then, I want to join or do a transaction with this (4th line) line
deal - 123456 - SAVED ack -- Time 10:46:46. to create a field called Dealsavedtime.

So, I want to check how long it took to grab the same deal.

Can you please help to get the logic? I tried join and subsearch, but subsearch is grabbing both lines like below and affecting results. I tried to use tail in subsearch, but did not work.

deal - 123456 - SAVED ack -- Time 10:46:46
deal - 123456 - SAVED ack -- Time 10:46:58

Re: join two fields from same source

esix_splunk — Tue, 19 May 2015 23:29:39 GMT

Assuming the event always ends with "SAVED ACK" you can use transaction and look at the duration. You need to extract that deal number as a field..

... | rex fields=_raw "deal - (?<deal_id>\d+)\s" | transaction deal_id endswith="SAVED ack" | table deal_id duration

Re: join two fields from same source

Arun_N_007 — Wed, 20 May 2015 05:20:23 GMT

Hi,

If you want the first acknowledgement (10:46:46) to be considered ignoring second (10:46:58). In sub search join you can filter using SAVED ACK and then do

..filter using "SAVED ACK"|sort by Time|convert dur2sec(Time) as TimeSec|eventstats min(TimeSec) as minTimeSec by dealId|where TimeSec==minTimeSec

above subsearch will return all the first SAVED ACKs.

You need to handle Day jump scenario by adding or negating 86400 to Time.