I have a log file from our ESB that has multiple events for each message. I want to join those back together so I can see how long the whole journey is taking, how many are not making it all the way, and so on.
I'm very new to Splunk, so I'm not at all sure how to chain those events together. Is having multiple queries of the same log chained together with the appendcols command a good approach? And, actually, even if I do that, how do I join an event from one query's result set to the matching event in the next query's result set?