Joining to another sourcetype based on field from one log message and correlating to a different log message in the same log

[danoconnl]

log a
5/14/2015 1pm [1150] <message><trnid>1001</trnid></message>
5/14/2015 1:01pm [1150]elapsed time = 1100

log b
5/14/2015 1pm, trnid=1001, 1200

so log a and b are linked on transaction id, and the two lines in log a are linked by the 1150.

I've got code that will pull the trnid out of the message, I just don't know how to link the two together and then use it to compare the elapsed time in log a to the third number in log b

Dan

[aholzer · Accepted solution]

Depending on what your end goal is you should use either of the following commands:
- Transaction
You'd have to transact on log a's ID, then transact with the trnid to log b. You'd end up with a single event with all three log lines aggregated, and all the fields from all three events would be available in your new aggregated event.

Your search would look something like this:

<base search for both log a and log b> | transaction <log a's id> keeporphans=true | transaction trnid

Make sure to use as many parameters/attributes in each of the transaction commands, because transaction can be an expensive command. Look into things like maxspan, maxpause, startswith, etc

OR
- Join
Basically you'd have to treat every part as a database table and join them separately. You'd end up with all the fields from all the events under a single event, but you would not have all the _raw messages from each event. Also note that join uses subsearches; subsearches are not efficient and have a default 10k limit to resulting events.

Your search would look something like this:

<your base search for log a type 1 events > | join <log a's id> [search <your base search for log a type 2 events> | join trnid [search <base search for log b>

Hope this helps

--- EDIT: fixed typos ---

[danoconnl]

Thanks for the help, figured it out