Extract data from an entry that is dependant on data from a different entry

[_dave_b]

Hello. I'm trying to extract a value from one log entry so I can use it to extract data from another entry, like
Entry 1 Has A and B
Entry 2 Has B and C
I want to get C from Entry 2 using A from Entry 1. I know I can use B to link them together somehow, but I don't know the command to do so. I've been trying subsearches and transactions, but nothing has worked for me.

Thanks for your help.

[the_wolverine · Accepted solution]

Assuming A, B, and C are field names.

• transaction:

  Entry1 OR Entry2 | transaction B

• subsearch:

  Entry2 | join B [ search Entry1 | fields A,B ] | table A,B,C

[jluo_splunk]

You can use the "where" command to compare field values (where field1=field2). Documentation for the where command: http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/Where

[_dave_b]

Thanks, but how do I shoehorn that into one search statement?

[jluo_splunk]

Can you post the search statement you are currently working with?

[_dave_b]

Sure,

date_year="2015" ClothingID="*" [search "Red"]  | rename ShoppingSessionID as Store_Visit | table Person, Store_Visit

I have 1 set of logs with multiple categories of entries. Some entries only have a person's ID, some only have a person's Shopping Session ID, and some have both a person's ID and Shopping session ID for a Successful Purchase (denoted by an entry of "Purchased Red Clothes"). Through these entries, I can link the person's ID to their particular Shopping Session where they made a purchase. I want to see who made a successful purchase of Red clothes.

[jluo_splunk]

Ah - I misunderstood the question. Transaction should do the trick.

source=log1 OR source=log2 | transaction CustomerID