Splunk Search

How to add field from different event for data model purpose

armahalma
New Member

Is there a way to add a field to an event from a different event assuming they have a common key using a simple search (without using pipe)? The reason being the resulting event will need to be tagged via event type (which doesn't allow complex search) so it can be included as part of a data model.

For example,

Event 1 - field A (common key): ABC, field B: Sunny

Event 2 - field A (common key): ABC, field C: Morning

Resulting Event 1: field A: ABC, field B: Sunny, field C: Morning

The final event will then be tagged so it can be included in the data model.

Appreciate any advice/suggestion.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

have you already try 

...
| stats values(*) as * by field_A

r. Ismo 

0 Karma

armahalma
New Member

Thanks, but as mentioned I could not use pipe char "|" as part of the search as it's limited by the eventtype definition. https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Eventtypesconf

Using "transaction" does provide the field I need as it groups the related events, but I need the field from the second event to be there on the first event permanently so when we do search it would appear as part of the result - so I can't really use "transaction" in this case.

Ideally the two events should have been ingested as a single event so we won't have this problem, but that's not the case.

Tags (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

If I understood your needs right you need to combine fields from two different events to one event? 

If so you definitely needs some commands which can do that "merge" from 2 to 1. I cannot (quickly) figure out any other ways than use | as a part of this merge.

Can you open little bit more about your use case if there is some other way to do it than what you have thinking (create data model).

r. Ismo

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>