Hi,
I am looking for a way to connection multiple events with two corresponding values together until I hit a condition of where there isn't a second corresponding value. Let me explain further. The data might look like this:
Event 1: current=1 new=2
Event 2: current=2 new=3
Event 3: current=3 new=4
.....
.....
Event 10: current=10 new=null
What I am looking to do is get to Event 10 from Event 1 and end with the value of 10. Basically this is a situation where an event might be the updating of an id, and only in that event is there a connection between the old id and the new id. This can happen several times and so in order to track the whole picture in splunk, I will need to start at the beginning and chain together all the events until I get to the event where the "new" id is nothing thus telling me that I'm at the end.
Any help or insight to this problem would be much appreciated.
Thank you for your help!
