Copy field to another event

[mihirpradhan]

Hello,

I'm searching doing a search in splunk for the "request_id" field. For example: request_id = "XXXXXXX"
It returns data from 2 sources. I can do a dedup and get the last event and it has everything I need except for the duration field. Is there a way I can pass the duration field and the value to another event before running dedup?

If yes, how can I do this in bulk? I have a subsearch with a table of request_id's. I use it to search for all events matching those request_id's. How can I make sure that for each individual request_id, the duration field is populated for all events?

Thanks

[DavidHourani · Accepted solution]

Hi @mihirpradhan,

Instead of dedup you can combine the events from multiple sources using stats as follows :

yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(duration) as duration, latest(fieldYouNeed) as fieldYouNeed by request_id 

Or if you need all the field, you can use a wildcard for your stats command :

 yourIndexAndSourcetype request_id = "XXXXXXX"  | stats latest(*) as * by request_id

This not only removes duplicates but also allows you to control what you keep from each event.

Let me know if this helps.

Cheers,
David

[mihirpradhan]

That worked perfect.

stats latest(*) as * by request_id is exactly what I was looking for!

[DavidHourani]

Awesome, glad I could help ! 🙂

[to4kawa]

yes, use stats range