Splunk Search

How to assign each event a fields value extracted from another event

emaccaferri
Communicator

Hi,
I need your help to understand which road to test.

I have raw events like this

  11/02/2013 sessionID1 fields1 fields2 ...
  11/02/2013 sessionID2 fields1 fields2 ...

and some other event instead

14/02/2013 sessionID1 fields3 field4 userID1 ...
17/02/2013 sessionID2 fields1 fields2 UserID1 ...

userID is populated only when a certain event occurs.

I would like to add the userID also to the event without it, to be albe to identify every action made by each user (in this way I can use transaction on userID).

    11/02/2013 sessionID1 fields1 fields2 userID1...
    11/02/2013 sessionID2 fields1 fields2 userID1...
    14/02/2013 sessionID1 fields3 field4 userID1 ...
    17/02/2013 sessionID2 fields1 fields2 userID1 ...

I was thinking to create, somehow outside Splunk, a lookup table with every sessionID connected with its userID.
Any idea to do somethink like this using only Splunk?

Thanks a lot for any suggestion

Tags (2)

somesoni2
Revered Legend

If you are able to create a lookup table file (say SessionUser.csv with fields sessionID and userID), then use following to get userID field for all the events.

your base search | lookup SessionUser.csv sessionID OUTPUT userID

This will add userID to all events provided a matching sessionID is present in the lookup table file.

Other less efficient options would be (without lookup) using join (would do the same)

<your base search> | join type=left sessionID [search <your base search> | stats count by sessionID, userID | fields - count ]
0 Karma

emaccaferri
Communicator

Thank you, but I wasn't asking how to use lookup, but efficient ways or ideas to how solve my problem

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...