Reporting

Merging data from multiple events into a single field

tchmielarski
Explorer

I want to merge data from multiple splunk events into a single field value - does anyone know how?
As an example, lets say we have antivirus data events which contain host name and the virus name. I can do a search to return all of the signatures for a specific host. My goal is to merge those signatures.

where the raw records (simplified) might be:
system_1, virus_a
system_1, virus_b
system_1, virus_c
system_2, virus_b

I want my output to be:
dest=system_1, infections="virus_a, virus_b, virus_c"

Tags (1)
0 Karma

tchmielarski
Explorer

the answer appears to be |transaction (thanks) plus |mvcombine
The delimiter (delim=",") does not show up, and i'm still working on that so the result is more legible but the current result is more or less what I wanted.

example:
.... |transaction dest_host maxspan=7d maxpause=7d | mvcombine delim="," signature

0 Karma

thinman
Explorer

Hi,

look for the transaction command basically adding to you search line:
" | transaction dest "

Don´t forget to include the pipe

Look on: Transaction definition

By the way don't forget to tag your fields!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...