How to write a search to match Event 3 with Event 1 and match Event 4 with Event 2?

[bharathkumarnec]

Hello All,

Need help in building a search. Below is my log file events format:

Event 1 -- RequestType1
Event 2 -- RequestType2
Event 3 -- Error Reply for RequestType1
Event 4 -- Success Reply for RequestType2

Now I have to formulate a search to match Event 3 with Event 1 & Event 4 with Event 2.

Note: If it is an error, no unique field will be there to match with Request Type1.

Kindly help me out on this.

Regards,

[sundareshr]

May be easier to extract the value for requesttype in to a field using something like this and then group, sort is one example of grouping. Best approach would depend on what you intend to do with the results. The regex below assumes request type is always at the end.

..| rex "\b(?<rt>\w+)\b$" | sort rt

[renjith_nair]

Try to formulate a search with following commands since you know better about the events and then shout in case you need any help

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Transaction

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Join

http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Stats

and look for similar questions

https://answers.splunk.com/answers/34107/joining-two-searches-with-and-without-stats-command.html

https://answers.splunk.com/answers/204782/how-to-join-two-search-events-that-have-a-common-f.html

https://answers.splunk.com/answers/138588/joining-multiple-events-via-a-common-field.html