Splunk Search

Joining logs on a field

jeffastorey
New Member

I have several log messages that are joined by a single field, id - each of the messages will include that field. What I would like to do is search all log messages for a particular term, and for any that match, return all of the log messages with those ids. For example, if I had the following messages:

id: 1, message: 'hello'
id: 1, message: 'world'

If my term is 'hello', I would want to return both messages with id 1 since one of the messages with id1 contains the term 'hello'.

I'm still pretty new to splunk querying, so any help here would be appreciated. Thanks!

Tags (2)
0 Karma
1 Solution

jeremiahc4
Builder

jeffastorey
New Member

Thanks, this should be a good start. Appreciate the help.

0 Karma

jeffastorey
New Member

I can't yet post a comment to your answer due to lack of points, but it looks like that alternative only works for aggregating stats, not seeing the raw events - is that correct?

0 Karma

jeremiahc4
Builder

Here is the alternative which is said to be more efficient.

http://answers.splunk.com/answers/53748/alternative-to-transaction-command.html

jeremiahc4
Builder

In this particular example it is just determining the transaction duration, and even in martin_mueller's response to the following thread it still seems to create a new view of the data which I'd modify to my taste...

http://answers.splunk.com/answers/133288/transactions-grouping-actions-and-matching-on-multiple-fiel...

something like;

| stats range(_time) as duration first(myfield) as myfield by transactionID 

But I don't see a way to then search that for the string "hello". You may have to use the transaction command if you want to do post-transaction searching. Hopefully someone can correct me on that and show us both how to use the stats command to do so.

0 Karma

jeremiahc4
Builder

The transaction command is a start, though I think there's a more efficient way to do it.

index=myindex <other search terms> | transaction id | search hello

While this will work, the problem as you can see is that the first search has to gather all matching events before handing off to the transaction command, which then has to be searched again.

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...