Splunk Search

How to generate a search that will list events together that have no common field?

New Member

I have three different events that compose a single email transaction that I need to list together. The problem is that they don't have a single field in common across all three events.

In eventA I have message_id and postfix_queue_id.
In eventB I have postfix_queue_id and PMX_queue_ID.
In eventC I have just the PMX_queue_ID.

I feel like this should be a pretty simple search string, but I can't seem to get the syntax to spit out the results I want.

0 Karma
1 Solution

Revered Legend

Give this a try. This will add all three fields to all events (message_id, postfix_queue_id and PMX_queue_ID).

(base search eventA) OR (base search eventB) OR  (base search eventC)
| eventstats values(postfix_queue_id) as temp by PMX_queue_ID | eval postfix_queue_id=coalesce(postfix_queue_id,temp)
| eventstats values(PMX_queue_ID) as temp by postfix_queue_id| eval PMX_queue_ID =coalesce(PMX_queue_ID ,temp) 
| eventstats values(message_id ) as temp by postfix_queue_id PMX_queue_ID | eval message_id =coalesce(message_id ,temp) 
| fields - temp

After that you can add appropriate command per your requirements. (transaction, stats, timechart etc)

View solution in original post

Splunk Employee
Splunk Employee

@cmo87 - Did the answer provided by somesoni2 help provide a working solution to your question? If yes, please don't forget to resolve this post by clicking "Accept". If no, please leave a comment with more feedback. Thanks!

0 Karma

Revered Legend

Give this a try. This will add all three fields to all events (message_id, postfix_queue_id and PMX_queue_ID).

(base search eventA) OR (base search eventB) OR  (base search eventC)
| eventstats values(postfix_queue_id) as temp by PMX_queue_ID | eval postfix_queue_id=coalesce(postfix_queue_id,temp)
| eventstats values(PMX_queue_ID) as temp by postfix_queue_id| eval PMX_queue_ID =coalesce(PMX_queue_ID ,temp) 
| eventstats values(message_id ) as temp by postfix_queue_id PMX_queue_ID | eval message_id =coalesce(message_id ,temp) 
| fields - temp

After that you can add appropriate command per your requirements. (transaction, stats, timechart etc)

View solution in original post

SplunkTrust
SplunkTrust

Sweet. That method is going in my toolbox.

This splunk / noSQL idea of just throwing everything in the same pot and then stirring until it unmixes itself. Brilliant.

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!