I am a Splunk beginner and have the following question.
I have some events I would like to transact, but not all field values are present in all events. E.g:
Event1: cookie, ip
Event2: c_ip (value is same as ip field in event1)
Event3: client_ip (value same as ip field in event1)
I want events that have different values for the field cookie, but the same IP to be put into a different transaction, so this is why I cannot just rename the ip fields and transact on the ip.
You need the coalesce command. Like this
... | eval ip=coalesce(ip, src_ip, client_ip) | transaction ip
thanks, but one more questioN: I can see how this will work for the ip fields I have, but will this help for transacting based on a unique cookie and ip pair? my situation is as follows:
event1: cookie=sugar, ip=1.0
event4: cookie=chocolate, ip=1.0
in this scenario, i want events 1-3 to be transacted together, and events 4-6 to be transacted together