Joining logs on a field

[jeffastorey]

I have several log messages that are joined by a single field, id - each of the messages will include that field. What I would like to do is search all log messages for a particular term, and for any that match, return all of the log messages with those ids. For example, if I had the following messages:

id: 1, message: 'hello'
id: 1, message: 'world'

If my term is 'hello', I would want to return both messages with id 1 since one of the messages with id1 contains the term 'hello'.

I'm still pretty new to splunk querying, so any help here would be appreciated. Thanks!

[jeffastorey]

Thanks, this should be a good start. Appreciate the help.

[jeffastorey]

I can't yet post a comment to your answer due to lack of points, but it looks like that alternative only works for aggregating stats, not seeing the raw events - is that correct?

[jeremiahc4 · Accepted solution]

Here is the alternative which is said to be more efficient.

http://answers.splunk.com/answers/53748/alternative-to-transaction-command.html

[jeremiahc4]

In this particular example it is just determining the transaction duration, and even in martin_mueller's response to the following thread it still seems to create a new view of the data which I'd modify to my taste...

http://answers.splunk.com/answers/133288/transactions-grouping-actions-and-matching-on-multiple-fiel...

something like;

| stats range(_time) as duration first(myfield) as myfield by transactionID 

But I don't see a way to then search that for the string "hello". You may have to use the transaction command if you want to do post-transaction searching. Hopefully someone can correct me on that and show us both how to use the stats command to do so.

[jeremiahc4]

The transaction command is a start, though I think there's a more efficient way to do it.

index=myindex <other search terms> | transaction id | search hello

While this will work, the problem as you can see is that the first search has to gather all matching events before handing off to the transaction command, which then has to be searched again.