Splunk Search

How to create a report based on different source types and include the results from a search on 1 source type that requires a transaction command?

guarisma
Contributor

Hello,

I have several different source types and I need to create a report on them, most of them have events with all the fields I need, but one of them doesn't because the events are broken into other events that can become a transaction.
When I pipe only those events to the transaction command I get all the fields I need, but I don't know how to incorporate the results with the other searches that don't require a transaction.

for example:

This is the search for my normal report:

index=* sourcetype=a sourcetype=b | table file_name, action, user

And this is the search I have to incorporate into the report:

index=* sourcetype=c | transaction id| table file_name, action, user

What can I do?

Thanks.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=* sourcetype=a OR sourcetype=b | table file_name, action, user | append [search index=* sourcetype=c | transaction id| table file_name, action, user]

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this

index=* sourcetype=a OR sourcetype=b | table file_name, action, user | append [search index=* sourcetype=c | transaction id| table file_name, action, user]

guarisma
Contributor

Yes, this works.
I also found the multisearch command, any recommendations on which might be better?

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...