Splunk Search

Copy field to another event

mihirpradhan
Explorer

Hello,

I'm searching doing a search in splunk for the "request_id" field. For example: request_id = "XXXXXXX"
It returns data from 2 sources. I can do a dedup and get the last event and it has everything I need except for the duration field. Is there a way I can pass the duration field and the value to another event before running dedup?

If yes, how can I do this in bulk? I have a subsearch with a table of request_id's. I use it to search for all events matching those request_id's. How can I make sure that for each individual request_id, the duration field is populated for all events?

Thanks

Labels (2)
Tags (1)
0 Karma
1 Solution

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

View solution in original post

DavidHourani
Super Champion

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

mihirpradhan
Explorer

That worked perfect.

stats latest(*) as * by request_id is exactly what I was looking for!

0 Karma

DavidHourani
Super Champion

Awesome, glad I could help ! 🙂

0 Karma

to4kawa
Ultra Champion

yes, use stats range

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...