How to combine two raw events based on status?

[moinyuso96]

The raw data was uploaded from a .txt file. I managed to create the table as below.

raw	TestFeatureName	Status	DateTime	Station
4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345	4015_ABCD	Start	8/11/2020 5:37:10 PM	12345
4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345	4015_ABCD	Complete	8/11/2020 5:37:30 PM	12345
4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345	4015_ABCD	Start	8/12/2020 10:23:34 AM	12345
1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890	1113_EFGH	Start	8/12/2020 12:00:00 PM	67890
1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890	1113_EFGH	Complete	8/12/2020 1:00:00 PM	67890

Are there any ways to combine two "raw" events based on the "status" field.

My expected result for "raw" field:

raw

4015_ABCD, Start, 8/11/2020 5:37:10 PM, 123454015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345

4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345

1113_EFGH, Start, 8/12/2020 12:00:00 PM, 678901113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890

[kamlesh_vaghela · Accepted solution]

@moinyuso96 

Can you please try this?

YOUR_SEARCH
| sort - _time
| transaction TestFeatureName  startswith="Start"
| fields _raw

My Sample Search :

| makeresults | eval _raw="raw	TestFeatureName	Status	DateTime	Station
4015_ABCD, Start, 8/11/2020 5:37:10 PM, 12345	4015_ABCD	Start	8/11/2020 5:37:10 PM	12345
4015_ABCD, Complete, 8/11/2020 5:37:30 PM, 12345	4015_ABCD	Complete	8/11/2020 5:37:30 PM	12345
4015_ABCD, Start, 8/12/2020 10:23:34 AM, 12345	4015_ABCD	Start	8/12/2020 10:23:34 AM	12345
1113_EFGH, Start, 8/12/2020 12:00:00 PM, 67890	1113_EFGH	Start	8/12/2020 12:00:00 PM	67890
1113_EFGH, Complete, 8/12/2020 1:00:00 PM, 67890	1113_EFGH	Complete	8/12/2020 1:00:00 PM	67890" | multikv forceheader=1
| table _time raw	TestFeatureName	Status	DateTime	Station
| rename raw as _raw
| eval t = 100 | accum t | eval _time = _time + t
| sort - _time
| transaction TestFeatureName  startswith="Start"
| fields _raw

 Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[aasabatini]

Hi @moinyuso96 

you can try with transaction command but be careful because is too heavy

https://docs.splunk.com/Documentation/Splunk/8.2.0/SearchReference/Transaction

Regards

Ale

[moinyuso96]

@aasabatini What do you mean by heavy? Will it affect the performance? Because I actually have to run thousands of these text files.