How to use Transaction command with two extracted join fields?

[jbrenner]

I have two Splunk queries, each of which uses the _rex command to extract the join field.

Example:

QUERY 1
index=index1 "Query1" | rex field=_raw "abc(?<MY_JOIN_FIELD>def)"

QUERY 2
index=index2 "Query2" | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"

I want to use the Transaction command to correlate these two queries, but I can't figure out how to do it.

Thanks!

Jonathan

[gcusello · Accepted solution]

Hi @jbrenner ,

you should try something like this:

index=index1  
| rex field=_raw "abc(?<MY_JOIN_FIELD>def)"
| append [ search 
     index=index2 
     | rex field=_raw "ghi(?<MY_JOIN_FIELD>jkl)"
     ]
| transaction <MY_JOIN_FIELD>
| ...

otherwise, you could extract both the MY_JOIN_FIELD before so you don't need to extract them in the search, in other words:

index=index1 OR index=index2
| transaction <MY_JOIN_FIELD>
| ...

But i invite you to think in a different way:

At first extract the two fields before and then try to use stats command instead of transaction:

index=index1 OR index=index2
| stats values(field1) AS field1 values(field2) AS field2 values(field3) AS field3 BY <MY_JOIN_FIELD>

where field1, field2 and field3 are the fields you need in your events.

This solution is very much performant than using transaction.

Ciao.

Giuseppe

[gcusello]

Hi @jbrenner,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

[jbrenner]

@gcusello Thanks Giuseppe! Worked like a charm! I originally considered your alternative solution, but this is a one-off scenario, and it's unlikely we will ever use these extracted fields again.