How to Group Events at Index Time?

[skoelpin]

I want to tie together 2 events at index time the same way I would tie them together at search time using the transaction command.

So for example I have this..

Mon Jul 11 13:57:29 2016
RW(16,148936) report:
RW: DBdelete return -1; fname=CM,key=01*123/456-7890


Mon Jul 11 13:57:29 2016
RW(16,148936) report:
Delete CM,'01*123/456-7890' failed

I created a field called key which will grab 01*123/456-7890 from both events and I can tie them together at search time using transaction.. index=sql | transaction Key.. But I want to do this at index time instead so the end user does not have to keep tieing them together with the transaction command each time they do a search

[skoelpin · Accepted solution]

What a bummer. I guess I could go that route or just use the transaction command as a saved search so they don't have to type it in each time

[somesoni2]

Or as a macro. You can also look at option of summary indexing just in case users don't need this data in real-time.

[skoelpin]

This is what I'll do! I'm willing to wait a half hour if it means I can get a performance boost at search time, thanks!

[somesoni2]

Have a look at this
https://answers.splunk.com/answers/62089/building-new-events-based-on-transactions-at-index-time.htm...