Splunk Search

How to assign each event a fields value extracted from another event


I need your help to understand which road to test.

I have raw events like this

  11/02/2013 sessionID1 fields1 fields2 ...
  11/02/2013 sessionID2 fields1 fields2 ...

and some other event instead

14/02/2013 sessionID1 fields3 field4 userID1 ...
17/02/2013 sessionID2 fields1 fields2 UserID1 ...

userID is populated only when a certain event occurs.

I would like to add the userID also to the event without it, to be albe to identify every action made by each user (in this way I can use transaction on userID).

    11/02/2013 sessionID1 fields1 fields2 userID1...
    11/02/2013 sessionID2 fields1 fields2 userID1...
    14/02/2013 sessionID1 fields3 field4 userID1 ...
    17/02/2013 sessionID2 fields1 fields2 userID1 ...

I was thinking to create, somehow outside Splunk, a lookup table with every sessionID connected with its userID.
Any idea to do somethink like this using only Splunk?

Thanks a lot for any suggestion

Tags (2)

Revered Legend

If you are able to create a lookup table file (say SessionUser.csv with fields sessionID and userID), then use following to get userID field for all the events.

your base search | lookup SessionUser.csv sessionID OUTPUT userID

This will add userID to all events provided a matching sessionID is present in the lookup table file.

Other less efficient options would be (without lookup) using join (would do the same)

<your base search> | join type=left sessionID [search <your base search> | stats count by sessionID, userID | fields - count ]
0 Karma


Thank you, but I wasn't asking how to use lookup, but efficient ways or ideas to how solve my problem

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...