i am pretty new to Splunk and i have the following Task.
I have four Systems with logs. I want to merge several fields from a log from one system to one field to generate a X-Trace-ID. I Need this X-Trace-ID to track the Transaction over the four Systems away.
Actually i could use the method of expanding the database of each Systems concerning one column and add an X-Trace-ID but we can't do that because of cost Problems.
Could you help me how can i generate in an alternative way a X-Trace-ID accross System boundaries?
Thank you very much and i am looking Forward for some answers.
Assuming I am understanding your request correctly, it sounds like you want to create a new field made up of a concatenation of other fields in the same event. If this is correct, try something like this: