How to add fields to already indexed events?

[exmuzzy]

Suppose I have "request event" and "response event"
They are linked together by the same value of the field id

Field session logged only in "response event"

2017-04-13 00:29:13,141
----------------------------
id=1
method: Ping
type: response
session=2
"request event" 

2017-04-13 00:29:13,138
----------------------------
id=1
method: Ping
type: request
"response event" 

I dislike of using SPL like "index=* [search session=2|return id]" to get all events by session=2.

I would prefer SPL "session=2"

When indexer processed "response event", is it possible to put extracted field session in an already parsed and indexed "request event" which can be find by the same value of the field id?

In other words, is it possible to add extra fields to "request event", that already parsed and stored in index, when parsing "response event"?

Other question: is it possible to find "request event" when parsing event, measure duration and save it as a field in currently parsing "response event"?

[mpreddy]

For Already indexed data you can extract fields in search time.

two ways you can use this cases:

• use transaction ID
• stats list() or values() by ID