How to merge two events?

[Khuzair81]

Event1 - Ticket_no = username*, id=111 Event2 - Ticket_no = TKT123, Id =0 Is there any way to merge this 2 events to get stats as : Ticket_no= TKT123, id=111

[richgalloway]

Try this.

<your base search> | eval username=coalesce(UserId, Ticket_no)
| stats values(*) as * by username

[Nisha18789]

hi @Khuzair81 , is there a common value between these two events, like how would you decide to merge these events, is this based on timestamps ? Also, you are trying to do this during search time right ?

[richgalloway]

How would Splunk know how to merge those events? They must have something in common and the example events do not.

[Khuzair81]

Hi @richgalloway

There is one thing common in both event but the column name is different. 

Event1 : Ticket_no - username123,

Event2 : Ticket_no. - TKT123, UserId - username123