Splunk Search

Copy field to another event

mihirpradhan
Explorer

Hello,

I'm searching doing a search in splunk for the "request_id" field. For example: request_id = "XXXXXXX"
It returns data from 2 sources. I can do a dedup and get the last event and it has everything I need except for the duration field. Is there a way I can pass the duration field and the value to another event before running dedup?

If yes, how can I do this in bulk? I have a subsearch with a table of request_id's. I use it to search for all events matching those request_id's. How can I make sure that for each individual request_id, the duration field is populated for all events?

Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

mihirpradhan
Explorer

That worked perfect.

stats latest(*) as * by request_id is exactly what I was looking for!

0 Karma

DavidHourani
Super Champion

Awesome, glad I could help ! 🙂

0 Karma

to4kawa
Ultra Champion

yes, use stats range

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...