Splunk Search

How to get fields in different events in a table?

Paul
Explorer

Hello:

I am trying to get fields from different events in the same table.

I have two different events, and let's say they have these fields:

First event:

Field1 = A

Field2 = B

Second event:

Field1 = A

Field3 = C

So if I run the following: 

index=whatever sourcetype=whatever | table Field1 Field2 Field3

I get a table like such:

Field1               Field2              Field3

A                             B

A                                                       C

 

I am trying to get the table to look like this, because Field1 is the same value:

Field1                       Field2                   Field3

A                                     B                               C

Basically, I am trying to pull a value from one event where the message IDs or session IDs are unique, and have Splunk go find another event with matching message IDs, and grab a different value from that separate event and output it to the same row in a table so the values in the table correspond with their respective message IDs.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Paul,

if the events com from the same index and have the same sourcetype, you have to group them using the stats command:

index=whatever sourcetype=whatever 
| stats values(Field2) AS Field2 values(Field3) AS Field3 BY Field1

choosing the common field for the BY clause and using the values option to avoid the list replication.

Ciao.

Giuseppe

0 Karma

Paul
Explorer

It worked.  Thank you very much.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Paul,

good for you, see next time!

Please accept one answer for the other people of Community

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...