Splunk Search

How to assign each event a fields value extracted from another event


I need your help to understand which road to test.

I have raw events like this

  11/02/2013 sessionID1 fields1 fields2 ...
  11/02/2013 sessionID2 fields1 fields2 ...

and some other event instead

14/02/2013 sessionID1 fields3 field4 userID1 ...
17/02/2013 sessionID2 fields1 fields2 UserID1 ...

userID is populated only when a certain event occurs.

I would like to add the userID also to the event without it, to be albe to identify every action made by each user (in this way I can use transaction on userID).

    11/02/2013 sessionID1 fields1 fields2 userID1...
    11/02/2013 sessionID2 fields1 fields2 userID1...
    14/02/2013 sessionID1 fields3 field4 userID1 ...
    17/02/2013 sessionID2 fields1 fields2 userID1 ...

I was thinking to create, somehow outside Splunk, a lookup table with every sessionID connected with its userID.
Any idea to do somethink like this using only Splunk?

Thanks a lot for any suggestion

Tags (2)

Revered Legend

If you are able to create a lookup table file (say SessionUser.csv with fields sessionID and userID), then use following to get userID field for all the events.

your base search | lookup SessionUser.csv sessionID OUTPUT userID

This will add userID to all events provided a matching sessionID is present in the lookup table file.

Other less efficient options would be (without lookup) using join (would do the same)

<your base search> | join type=left sessionID [search <your base search> | stats count by sessionID, userID | fields - count ]
0 Karma


Thank you, but I wasn't asking how to use lookup, but efficient ways or ideas to how solve my problem

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...