Splunk Search

How to merge 2 messages into 1 message?

New Member

Hi,

Is there a way to merge 2 messages into 1 message? For example I have a sequence of messages:

TestingData numTests=3
TestingCompleted start=10:00am end=3:00pm
TestingData numTest=2
TestingCompleted start=11:00am end=1:00pm

I would like this to look like below where 1+2 are merged and 3+4 are merged.

TestingData numTests=3  start=10:00am end=3:00pm
TestingData numTest=2 start=11:00am end=1:00pm

If either a TestingData or TestingCompleted row was missing then NA for that element of the merged row. So, if row 1 was missing then we would have below. The msg sequence order is fairly guaranteed.

NA  start=10:00am end=3:00pm
TestingData numTest=2 start=11:00am end=1:00pm

Thanks!

Tags (2)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

It would be much easier if you were repeating the numTest on each line (to use a common grouping value)

You can try to regroup with a transaction at search time.
see http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Transaction

look at the "startswith" and "endswith" options.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

It would be much easier if you were repeating the numTest on each line (to use a common grouping value)

You can try to regroup with a transaction at search time.
see http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Transaction

look at the "startswith" and "endswith" options.

View solution in original post

0 Karma

New Member

It works with this, thanks!

0 Karma

SplunkTrust
SplunkTrust

Do your events have any common fields based which they can be merged??

0 Karma

New Member

No, there are none! I was thinking it might be -- take if the first row contains "TestingData" (else first row is set to "NA") and then merge with the next row if it contains "TestingCompleted" (else if second row is missing then set to "NA"), so it would be more like a row count type of thing instead of anything solid like an id field ... but I'm not sure if that's the best way.

And I'm not sure how to accomplish the above either, so any help is appreciated. Thanks!

0 Karma