Splunk Search

How to build a transaction from multiple, somewhat disparate, indexes

castle1126
Communicator

Hi,

I have three indexes that I'm trying to build a transaction from. the first two indexes each have a field named User_Name, which makes the transaction statement pretty easy. This creates the base transaction I'm looking for.

The first index also has a field called ip. What I want to do is use this field to retrieve the events from the third index into the first transaction (unfortunately the User_Name field does not exist in the third index). I've tried so many different searches, all never result in a transaction containing all the pertinent records.

Any thoughts on how to create this type of transaction?

Thanks!!

Tags (1)

BenAveling
Path Finder

Does the 3rd index have ip? If so, what happens when you try to build a transaction on ip and user_name?

0 Karma

curtgran
Explorer

Maybe this isn't the best place to ask this question but I'll try anyway.

Can I transaction span multiple indexes and multiple sourcetypes? It seems like it can but I thought I would ask to verify it.

Curt

0 Karma

sdwilkerson
Contributor

Curtgan, Yes, this isn't the right place, you should really have started a new question. But the answer to your question is, yes, transaction doesn't care so long as the time settings and field are right.

0 Karma

sdwilkerson
Contributor

What fields do exists in the third index that might be used to unite those events with events from one of the first two indexes? A subsearch or double-transaction might work.

0 Karma

castle1126
Communicator

The username field does not exist from the third index.

0 Karma

b4ggio
Explorer

I am also keen to see what the data looks like as mentioned by southeringtonp. Have you thought about doing data enrichment using a lookup of some unique data and then using the new field to transact on.

southeringtonp
Motivator

What does your data look like? Is the username completely missing from the third index, or just not extracted into that field?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.