I want to join events within the same sourcetype into a single event based on a logID field. However, this logID field can be named in two different ways: primary.logID
or secondary.logID
. Our sourcetype has both primary and secondary events, and we use a common logID between them if they are related.
If I do |transaction primary.logID
it obviously doesn't work, but I can't rename the two primary and secondary logID's to a new logID
field, because it is in the same sourcetype. How do I transaction these events together on the same name?
Any reason you can't create a new logID field and set it to whichever field has data? Maybe using coalesce?
... | eval logID = coalesce('primary.logID','secondary.logID') | transaction logID
Note: I can never remember when splunk want single quotes and when it doesn't, but I think it does for fields with a "." but not positive they're needed.
Any reason you can't create a new logID field and set it to whichever field has data? Maybe using coalesce?
... | eval logID = coalesce('primary.logID','secondary.logID') | transaction logID
Note: I can never remember when splunk want single quotes and when it doesn't, but I think it does for fields with a "." but not positive they're needed.
Yep, coalesce works just right for me, thanks! Didn't know that existed. And it has to be single quotes inside the eval function to work, if I use anything else the resultant value is blank.