topic Re: How to Group Events at Index Time? in Splunk Search

How to Group Events at Index Time?

skoelpin — Mon, 11 Jul 2016 18:14:05 GMT

I want to tie together 2 events at index time the same way I would tie them together at search time using the transaction command.

So for example I have this..

Mon Jul 11 13:57:29 2016
RW(16,148936) report:
RW: DBdelete return -1; fname=CM,key=01*123/456-7890


Mon Jul 11 13:57:29 2016
RW(16,148936) report:
Delete CM,'01*123/456-7890' failed

I created a field called key which will grab 01*123/456-7890 from both events and I can tie them together at search time using transaction.. index=sql | transaction Key.. But I want to do this at index time instead so the end user does not have to keep tieing them together with the transaction command each time they do a search

Re: How to Group Events at Index Time?

somesoni2 — Mon, 11 Jul 2016 18:44:30 GMT

Have a look at this
https://answers.splunk.com/answers/62089/building-new-events-based-on-transactions-at-index-time.html

Re: How to Group Events at Index Time?

skoelpin — Mon, 11 Jul 2016 20:16:35 GMT

What a bummer. I guess I could go that route or just use the transaction command as a saved search so they don't have to type it in each time

Re: How to Group Events at Index Time?

somesoni2 — Mon, 11 Jul 2016 20:28:06 GMT

Or as a macro. You can also look at option of summary indexing just in case users don't need this data in real-time.

Re: How to Group Events at Index Time?

skoelpin — Mon, 11 Jul 2016 20:34:43 GMT

This is what I'll do! I'm willing to wait a half hour if it means I can get a performance boost at search time, thanks!