How to fill a specific value using chosen field?

[Jackiifilwhh]

Hey partner

In my system, every visit consist of one or more transactions and every has its global serial number, which is unique(gsn for short). A transaction may produce many rows of logs, which is event in Splunk,  but it has the same gsn. A transaction always ends with "trans end transName", while the "transName" means the name of the transaction, a transaction named Test ends with "trans end Test", for example. Every transaction's name is unique and just appear once per gsn.

I can get the transaction's name by using the command below.

rex "trans end (?<transName>\w+)"

 I want to fill a common transName field for every event. For example, a transaction log 3 rows, which are treated as 3 events in Splunk. Its gsn is 10000 and its raw logs is like below:

GlobalseqNo:10000 trans end Test
GlobalseqNo:10000 log 2
GlobalseqNo:10000 log 1

When I just use the command below, the result is like the table below

rex "trans end (?<transName>\w+)"
| table gsn transName

gsn	transName
10000	Test
10000
10000

 I want to fill a common transName field for every event. So when there are a lot of transactions, the command above will produce the result below

gsn	transName
10000	Test
10000	Test
10000	Test
10001	A
10001	A
10002	B
10002	B

[ITWhisperer · Accepted solution]

| eventstats values(transName) as transName by gsn

[Jackiifilwhh]

Hi @ITWhisperer 

Thank you! It works very well!

I have another question to ask you:

I learn SPL by downloading several pdfs just like below. The SearchReference.pdf is the one I read the most.

The 'eventstats' command is explained in it, but it doesn't explain the combination of 'eventstats' and 'values'.It is more like a dictionary. I think it's hard to get the solution you've posted to me to the problem, just by my myself. So I can't fix the complex problems.
I want to get a better way to learn SPL, can you give me some advice?

Best wishes!

[ITWhisperer]

Some might say that tutorials and training courses are a good way to go.

However, I have taken a different approach.

Most of what I have learnt has been self-taught, mainly through this community.

I look through the questions people are asking, and try to figure out how I would solve it.

If I get stuck, I look at other people's answers and try them out.

I have a couple of virtual machines set up with splunk, so I can generate some of the scenarios people are struggling with, away from my production environment. This allows me to try different things and figure out how SPL works.

It also means I can try out new releases ahead of my production environment, and even load up older releases, if appropriate to the issue being raised.

Once I have figured out a solution, I will often create a test dashboard in one of my environments so that I have the solution on hand should I need it to either answer someone else's question or include it in my own production dashboards.

[Jackiifilwhh]

Thank you! From you, I can learn that practice is the best teacher!