topic Group records by two fields in Splunk Search

Group records by two fields

varun99 — Wed, 07 Mar 2018 01:36:05 GMT

Hi,

I have the data like below:

TransactionID1 TransactionID2
aaaaaaaaaaaa aaaaaaaaaaaa
aaaaaaaaaaaa bbbbbbbbbbb
bbbbbbbbbbb
ccccccccccccc ccccccccccccc
ccccccccccccc ccccccccccccc
ccccccccccccc

I need to group some records based on the above two fields in a way that the first three records come together and last three come together based on the fact that any of the TransactionID1 or TransactionID2 are same. It is a bit easy to group the last three. However, I am finding it difficult to group the 1st three. Kindly help.

Re: Group records by two fields

DalJeanis — Wed, 07 Mar 2018 21:47:38 GMT

We need to see a little bit more of the actual search or the actual data to understand what you are having problems with.

Re: Group records by two fields

hortonew — Sat, 10 Mar 2018 18:11:01 GMT

Also, what would your desired output look like? I imagine you're trying to group events together if either trans1 or trans2 match the previous one, but break into a new group should neither match.