Splunk Search

How to transaction on two different fields within the same sourcetype?

brajaram
Communicator

I want to join events within the same sourcetype into a single event based on a logID field. However, this logID field can be named in two different ways: primary.logID or secondary.logID. Our sourcetype has both primary and secondary events, and we use a common logID between them if they are related.

If I do |transaction primary.logID it obviously doesn't work, but I can't rename the two primary and secondary logID's to a new logID field, because it is in the same sourcetype. How do I transaction these events together on the same name?

Tags (2)
0 Karma
1 Solution

maciep
Champion

Any reason you can't create a new logID field and set it to whichever field has data? Maybe using coalesce?

... | eval logID = coalesce('primary.logID','secondary.logID') | transaction logID

Note: I can never remember when splunk want single quotes and when it doesn't, but I think it does for fields with a "." but not positive they're needed.

View solution in original post

maciep
Champion

Any reason you can't create a new logID field and set it to whichever field has data? Maybe using coalesce?

... | eval logID = coalesce('primary.logID','secondary.logID') | transaction logID

Note: I can never remember when splunk want single quotes and when it doesn't, but I think it does for fields with a "." but not positive they're needed.

brajaram
Communicator

Yep, coalesce works just right for me, thanks! Didn't know that existed. And it has to be single quotes inside the eval function to work, if I use anything else the resultant value is blank.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...