Splunk Search

How to add fields to already indexed events?

exmuzzy
Explorer

Suppose I have "request event" and "response event"
They are linked together by the same value of the field id

Field session logged only in "response event"

2017-04-13 00:29:13,141
----------------------------
id=1
method: Ping
type: response
session=2
"request event" 

2017-04-13 00:29:13,138
----------------------------
id=1
method: Ping
type: request
"response event" 

I dislike of using SPL like "index=* [search session=2|return id]" to get all events by session=2.

I would prefer SPL "session=2"

When indexer processed "response event", is it possible to put extracted field session in an already parsed and indexed "request event" which can be find by the same value of the field id?

In other words, is it possible to add extra fields to "request event", that already parsed and stored in index, when parsing "response event"?

Other question: is it possible to find "request event" when parsing event, measure duration and save it as a field in currently parsing "response event"?

Tags (2)
0 Karma

mpreddy
Communicator

For Already indexed data you can extract fields in search time.

two ways you can use this cases:

  • use transaction ID
  • stats list() or values() by ID
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...