How do I create a transaction when not all fields are present?

[mayakulkarni]

Hi!

I am a Splunk beginner and have the following question.

I have some events I would like to transact, but not all field values are present in all events. E.g:

Event1: cookie, ip
Event2: c_ip (value is same as ip field in event1)
Event3: client_ip (value same as ip field in event1)

I want events that have different values for the field cookie, but the same IP to be put into a different transaction, so this is why I cannot just rename the ip fields and transact on the ip.

Thanks!

[sundareshr]

You need the coalesce command. Like this

... | eval ip=coalesce(ip, src_ip, client_ip) | transaction ip 

http://blogs.splunk.com/2014/03/21/search-command-coalesce/

[mayakulkarni]

thanks, but one more questioN: I can see how this will work for the ip fields I have, but will this help for transacting based on a unique cookie and ip pair? my situation is as follows:

event1: cookie=sugar, ip=1.0
event2: c_ip=1.0
event3: client_ip=1.0

event4: cookie=chocolate, ip=1.0
event5: c_ip=1.0
event6: client_ip=1.0

in this scenario, i want events 1-3 to be transacted together, and events 4-6 to be transacted together