Splunk Search

Copy field to another event

mihirpradhan
Explorer

Hello,

I'm searching doing a search in splunk for the "request_id" field. For example: request_id = "XXXXXXX"
It returns data from 2 sources. I can do a dedup and get the last event and it has everything I need except for the duration field. Is there a way I can pass the duration field and the value to another event before running dedup?

If yes, how can I do this in bulk? I have a subsearch with a table of request_id's. I use it to search for all events matching those request_id's. How can I make sure that for each individual request_id, the duration field is populated for all events?

Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

mihirpradhan
Explorer

That worked perfect.

stats latest(*) as * by request_id is exactly what I was looking for!

0 Karma

DavidHourani
Super Champion

Awesome, glad I could help ! 🙂

0 Karma

to4kawa
Ultra Champion

yes, use stats range

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...