Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question

Unified log - how to?

shayhibah
Path Finder
‎03-12-2018 02:35 AM

Hi,

I would like to know if there is option to unify logs based on id or something else.

For example:
I have the initial log and after 15 sec, I get an update for that log (not necessarily sequential).

Is there any option to merge them into 1 log (instead of 2) and doing it before indexing (since I want to index 1 log)?

Thanks,
Shay

0 Karma
Reply

p_gurav
Champion
‎03-12-2018 06:01 AM

Hi,

You can do that with transaction command. Also refer documents for it:
https://docs.splunk.com/Documentation/Splunk/7.0.2/SearchReference/Transaction

0 Karma
Reply
Get Updates on the Splunk Community!

Unlock Database Monitoring with Splunk Observability Cloud

In today’s fast-paced digital landscape, even minor database slowdowns can disrupt user experiences and stall ...

Print, Leak, Repeat: UEBA Insider Threats You Can't Ignore

Are you ready to uncover the threats hiding in plain sight? Join us for "Print, Leak, Repeat: UEBA Insider ...

Splunk MCP & Agentic AI: Machine Data Without Limits

  Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization ...