Search String but retain values

[tb5821]

new to splunk so go easy on me

I can currently run two different searches and get the the results I'm looking for but the problem is that its two different searches 🙂

The only field which they have in common is task_id how can I run both of these searches together still get the lines with the strings I'm interested in? Also within each search I'm renaming some of my fields ie ... | rename tt AS "Encode Time" and my other search is ... | rename tt AS "Copy Time"

[gkanapathy]

try this:

(sourcetype=A "encode") OR (sourcetype=B copying) | eval encode_time=if(searchmatch("encode"),tt,null()) | eval copy_time=if(searchmatch("copying"),tt,null())

Also, depending what you're doing the ... | stats ... by task_id command may be better than transaction task_id

[tb582]

does it matter that my source types are both the same?

[Damien_Dallimor · Accepted solution]

Try the transaction search command to stitch events together based on the common field :

... | transaction task_id

Not sure about the field renaming without seeing more concise examples of the events.

[Damien_Dallimor]

You can setup Splunk "event types" for your different tasks.

http://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Abouteventtypes

[tb582]

Unfortuantly I don't think its that easy I've tried all sorts of things join, set, append but just either not doing it in the right order or not doing it right at all. Here's an example of the two queries.

index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Encode completed" | rename Task_time as "Encode Time"

search index=myindex sourcetype=app host=1* OR host=050 "SUCCESS : 100% : Push Completed" | rename Task_time as "Transfer Time"