topic Re: How to create a report based on different source types and include the results from a search on 1 source type that requires a transaction command? in Splunk Search

How to create a report based on different source types and include the results from a search on 1 source type that requires a transaction command?

guarisma — Mon, 24 Oct 2016 23:05:25 GMT

Hello,

I have several different source types and I need to create a report on them, most of them have events with all the fields I need, but one of them doesn't because the events are broken into other events that can become a transaction.
When I pipe only those events to the transaction command I get all the fields I need, but I don't know how to incorporate the results with the other searches that don't require a transaction.

for example:

This is the search for my normal report:

index=* sourcetype=a sourcetype=b | table file_name, action, user

And this is the search I have to incorporate into the report:

index=* sourcetype=c | transaction id| table file_name, action, user

What can I do?

Thanks.

Re: How to create a report based on different source types and include the results from a search on 1 source type that requires a transaction command?

somesoni2 — Tue, 25 Oct 2016 03:24:12 GMT

Try like this

index=* sourcetype=a OR sourcetype=b | table file_name, action, user | append [search index=* sourcetype=c | transaction id| table file_name, action, user]

Re: How to create a report based on different source types and include the results from a search on 1 source type that requires a transaction command?

guarisma — Tue, 25 Oct 2016 13:36:14 GMT

Yes, this works.
I also found the multisearch command, any recommendations on which might be better?

Thanks