Splunk Search

How to Group Events at Index Time?

skoelpin
SplunkTrust
SplunkTrust

I want to tie together 2 events at index time the same way I would tie them together at search time using the transaction command.

So for example I have this..

Mon Jul 11 13:57:29 2016
RW(16,148936) report:
RW: DBdelete return -1; fname=CM,key=01*123/456-7890


Mon Jul 11 13:57:29 2016
RW(16,148936) report:
Delete CM,'01*123/456-7890' failed

I created a field called key which will grab 01*123/456-7890 from both events and I can tie them together at search time using transaction.. index=sql | transaction Key.. But I want to do this at index time instead so the end user does not have to keep tieing them together with the transaction command each time they do a search

Tags (2)
0 Karma
1 Solution

skoelpin
SplunkTrust
SplunkTrust

What a bummer. I guess I could go that route or just use the transaction command as a saved search so they don't have to type it in each time

View solution in original post

0 Karma

skoelpin
SplunkTrust
SplunkTrust

What a bummer. I guess I could go that route or just use the transaction command as a saved search so they don't have to type it in each time

0 Karma

somesoni2
Revered Legend

Or as a macro. You can also look at option of summary indexing just in case users don't need this data in real-time.

skoelpin
SplunkTrust
SplunkTrust

This is what I'll do! I'm willing to wait a half hour if it means I can get a performance boost at search time, thanks!

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...