topic Re: Joining entries using IDs in Splunk Search

Joining entries using IDs

m_hunger — Wed, 15 Aug 2012 11:41:49 GMT

Hi,

I am trying to extract an ID from a search and append the results using the extracted ID.

Example:
Search: host="hostname" 32351
<190>Aug 15 11:28:02 hostname sshd[32351]: User child is on pid 32353

Now I would like to append the entries including the child pid, e.g.
Search: host="hostname" 32351 OR 32353 without having to type "OR 32353".

Here, Splunk adds all entries with all child pid's and not only those from the main search:
host="hostname" pid=32351 | append [search host="hostname" | fields + childpid]

So I am probably missing something before append. I hope it is enough information.

Re: Joining entries using IDs

kristian_kolb — Wed, 15 Aug 2012 13:10:11 GMT

If you have the field extractions for pid and childpid configured already, you could simply get the children of a pid by

host=hostname | stats values(childpid) by pid

UPDATE:

Hmm, not 100% sure I follow you, but...

host=hostname pid=12345 OR [search host=hostname pid=12345 | rename childpid as pid | fields + pid]

..something like this might work.

Hope this helps,

Kristian

Re: Joining entries using IDs

m_hunger — Wed, 15 Aug 2012 13:27:35 GMT

At least it makes a correct connection, but I need the complete logentries.

What I basically need is:
SELECT * FROM sshd a, internal-sftp b WHERE a.pid="1000" AND a.childpid = b.pid;

Re: Joining entries using IDs

Ayn — Wed, 15 Aug 2012 14:13:04 GMT

Did you look into using transaction?

Re: Joining entries using IDs

kristian_kolb — Wed, 15 Aug 2012 15:30:52 GMT

see update above /k