https://community.splunk.com/t5/Splunk-Search/How-to-connect-two-transaction-commands-from-3-sources-linked-by/m-p/233661#M69414 <P>I want to track a single transaction through three different events. </P> <P><STRONG>Event A</STRONG> and <STRONG>Event B</STRONG> share a common field <STRONG>f1</STRONG> which links the events as a transaction<BR /> <STRONG>Event B</STRONG> and <STRONG>Event C</STRONG> share a common field <STRONG>f2</STRONG> which links the events as a transaction<BR /> <STRONG>Event A</STRONG> does not contain <STRONG>f2</STRONG>.<BR /> <STRONG>Event C</STRONG> does not contain <STRONG>f1</STRONG></P> <P>I have a search like the following</P> <PRE><CODE>event=A OR event=B OR event=C | transaction f1 maxspan=2s keeporphans=true keepevicted=true | transaction f2 maxspan=2s | table f1 f2 other_field_unique_to_A other_field_unique_to_B other_field_unique_to_C </CODE></PRE> <P>Events of type <STRONG>A</STRONG> and <STRONG>B</STRONG> are joined exactly how I like - on field <STRONG>f1</STRONG>. Their unique fields appear together on the same line of the output table.<BR /> In the output table, I can see all the events of type <STRONG>C</STRONG>, but none of them are ever joined in to the corresponding transactions of type A and B.</P> <P>What can be done here?</P> Mon, 09 Jan 2017 23:40:08 GMT e_psilo_n 2017-01-09T23:40:08Z https://community.splunk.com/t5/Splunk-Search/How-to-connect-two-transaction-commands-from-3-sources-linked-by/m-p/233661#M69414 <P>I want to track a single transaction through three different events. </P> <P><STRONG>Event A</STRONG> and <STRONG>Event B</STRONG> share a common field <STRONG>f1</STRONG> which links the events as a transaction<BR /> <STRONG>Event B</STRONG> and <STRONG>Event C</STRONG> share a common field <STRONG>f2</STRONG> which links the events as a transaction<BR /> <STRONG>Event A</STRONG> does not contain <STRONG>f2</STRONG>.<BR /> <STRONG>Event C</STRONG> does not contain <STRONG>f1</STRONG></P> <P>I have a search like the following</P> <PRE><CODE>event=A OR event=B OR event=C | transaction f1 maxspan=2s keeporphans=true keepevicted=true | transaction f2 maxspan=2s | table f1 f2 other_field_unique_to_A other_field_unique_to_B other_field_unique_to_C </CODE></PRE> <P>Events of type <STRONG>A</STRONG> and <STRONG>B</STRONG> are joined exactly how I like - on field <STRONG>f1</STRONG>. Their unique fields appear together on the same line of the output table.<BR /> In the output table, I can see all the events of type <STRONG>C</STRONG>, but none of them are ever joined in to the corresponding transactions of type A and B.</P> <P>What can be done here?</P> Mon, 09 Jan 2017 23:40:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-connect-two-transaction-commands-from-3-sources-linked-by/m-p/233661#M69414 e_psilo_n 2017-01-09T23:40:08Z https://community.splunk.com/t5/Splunk-Search/How-to-connect-two-transaction-commands-from-3-sources-linked-by/m-p/233662#M69415 <P>Give this a try</P> <PRE><CODE>event=A OR event=B OR event=C | eventstats values(f1) as f1_temp by f2 | eval f1=coalesce(f1,f1_temp) | eventstats values(f2) as f2_temp by f1 | eval f2=coalesce(f2,f2_temp) | stats values(uniqfield1) as uniqfiel1 values(uniqfield2) as uniqfield2.... by f1 f2 </CODE></PRE> Tue, 10 Jan 2017 00:04:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-connect-two-transaction-commands-from-3-sources-linked-by/m-p/233662#M69415 somesoni2 2017-01-10T00:04:57Z