I have a main search which groups me together all the events with a unique ID (these events are critical, warning and normal alerts that I index on Splunk). I want to add a sub-search to my main search which could allow me to add other events in the form of a transaction. My problem here is that my unique ID in my main search is not the same as in my sub search. this is what I want to do :
index=index1 (severity=2 OR severity=0 OR severity=1 OR (severity="-1" AND Function=Traps)) | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+managed_entity+"_"+varname | addinfo
| append [search index=index_sqlprod-itrs_toc (managed_entity="vpw-neorc-103 - rec" OR managed_entity="vpw-neorc-903 - rec") rowname="ASC RecordingControl" | eval ID=Service+"_"+Env+"_"+Apps+"_"+Function+"_"+varname | addinfo | sort _time asc | eval peer_failed=if(severity=2,1,-1) | streamstats sum(peer_failed) as failed_peers by ID | eval failed_peers=if((failed_peers=1) AND (severity="0" OR severity="-1"),3,failed_peers) | where NOT (failed_peers=1 OR failed_peers=0) | sort _time desc | transaction ID startswith=(failed_peers=2) endswith=(failed_peers=3) maxevents=2]
| transaction ID startswith=(severity=2) maxevents=2
my goal is to bring these transactions together without having the same ID, is that possible?