How to transaction on two different fields within the same sourcetype?

[brajaram]

I want to join events within the same sourcetype into a single event based on a logID field. However, this logID field can be named in two different ways: primary.logID or secondary.logID. Our sourcetype has both primary and secondary events, and we use a common logID between them if they are related.

If I do |transaction primary.logID it obviously doesn't work, but I can't rename the two primary and secondary logID's to a new logID field, because it is in the same sourcetype. How do I transaction these events together on the same name?

[maciep · Accepted solution]

Any reason you can't create a new logID field and set it to whichever field has data? Maybe using coalesce?

... | eval logID = coalesce('primary.logID','secondary.logID') | transaction logID

Note: I can never remember when splunk want single quotes and when it doesn't, but I think it does for fields with a "." but not positive they're needed.

[brajaram]

Yep, coalesce works just right for me, thanks! Didn't know that existed. And it has to be single quotes inside the eval function to work, if I use anything else the resultant value is blank.