Splunk Search

How do I create a transaction when not all fields are present?

New Member


I am a Splunk beginner and have the following question.

I have some events I would like to transact, but not all field values are present in all events. E.g:

Event1: cookie, ip
Event2: c_ip (value is same as ip field in event1)
Event3: client_ip (value same as ip field in event1)

I want events that have different values for the field cookie, but the same IP to be put into a different transaction, so this is why I cannot just rename the ip fields and transact on the ip.


0 Karma


You need the coalesce command. Like this

... | eval ip=coalesce(ip, src_ip, client_ip) | transaction ip 


0 Karma

New Member

thanks, but one more questioN: I can see how this will work for the ip fields I have, but will this help for transacting based on a unique cookie and ip pair? my situation is as follows:

event1: cookie=sugar, ip=1.0
event2: c_ip=1.0
event3: client_ip=1.0

event4: cookie=chocolate, ip=1.0
event5: c_ip=1.0
event6: client_ip=1.0

in this scenario, i want events 1-3 to be transacted together, and events 4-6 to be transacted together

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!