Splunk Search

Combine 2 or more strings based on a comman field

batham
Explorer

Hi I am tracking service requests and responses and trying to create a table that contains both requests and response but requests and responses are in different lines ingested in splunk.

I have a common field (trace) which is available in both the strings and unique for a set of request and response pairs,

 example

line1: trace: 12345 , Request Received: {1}, URL:http://

line2: trace: 12346 , Request Received: {2}, URL:http://

line3: trace:12345 , Reponse provided: {3}

line4: trace:12346 , Reponse provided :{4}

 

In line1 and line 3 trace is common field and so is in line 1 and line 4

I want end result like in a table

 

trace      request     response

12345   {1}            {3}

12346  {2}            {4}

 

Tags (1)
0 Karma
1 Solution

batham
Explorer

Inner join actually worked for this.

View solution in original post

0 Karma

batham
Explorer

Inner join actually worked for this.

0 Karma

yuanliu
SplunkTrust
SplunkTrust

If those lines are the only text in raw data, you can do

 

| extract pairdelim="," kvdelim=":"
| fields - _raw
| stats values(Request_Received) as request values(Response_provided) as response by trace

 

The result is

traceresponserequest
12345{3}{1}
12346{4}{2}

 

Tags (1)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...