Eg
eg in fuse.log I have a entry like userId=abc
while in access.log i have entry like sessionid-12232 | abc | xyz
Output I want is like
abc | xyz | sessionid-12232
Can you please suggest how can i join these two using pattern
Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.
source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
| makeresults
| eval _raw="userId=abc,session=123,time=12:00_IST"
| kv
| eval time=replace(time,"_"," ")
| append
[| makeresults
| eval _raw="foo-abc-12:00 IST-data" ]
`comment("this is sample data")`
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userId
| eval session="sessionid-".session
| table userId user session
I uased @richgalloway 's query, thanks.
source=fuse.log OR source=access.log
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userid
| eval session="sessionid-".session
| table userid user sessionid
How about this?
Thanks @richgalloway @to4kawa
Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.
source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
hey, Thank you very much for the response but the scenario is little different
in fuse.log I have fields like
userId=abc | session=123 | time=12:00 IST
so splunk is able to concider then as 3 fields i.e. userId,session,time
while in access.log i only have values but not field name i.e
foo-abc-12:00 IST-data
What I need to achieve is get the userid from fuse.log and find that id in access.log and print userid |session | data
This information should have been included in the question.
@to4kawa's answer should do the job.