How to merge 2 messages into 1 message?

[ceng]

Hi,

Is there a way to merge 2 messages into 1 message? For example I have a sequence of messages:

TestingData numTests=3
TestingCompleted start=10:00am end=3:00pm
TestingData numTest=2
TestingCompleted start=11:00am end=1:00pm

I would like this to look like below where 1+2 are merged and 3+4 are merged.

TestingData numTests=3  start=10:00am end=3:00pm
TestingData numTest=2 start=11:00am end=1:00pm

If either a TestingData or TestingCompleted row was missing then NA for that element of the merged row. So, if row 1 was missing then we would have below. The msg sequence order is fairly guaranteed.

NA  start=10:00am end=3:00pm
TestingData numTest=2 start=11:00am end=1:00pm

Thanks!

[yannK · Accepted solution]

It would be much easier if you were repeating the numTest on each line (to use a common grouping value)

You can try to regroup with a transaction at search time.
see http://docs.splunk.com/Documentation/Splunk/6.3.3/SearchReference/Transaction

look at the "startswith" and "endswith" options.

[ceng]

It works with this, thanks!

[somesoni2]

Do your events have any common fields based which they can be merged??

[ceng]

No, there are none! I was thinking it might be -- take if the first row contains "TestingData" (else first row is set to "NA") and then merge with the next row if it contains "TestingCompleted" (else if second row is missing then set to "NA"), so it would be more like a row count type of thing instead of anything solid like an id field ... but I'm not sure if that's the best way.

And I'm not sure how to accomplish the above either, so any help is appreciated. Thanks!