Splunk Search

Transacting Events Across Different Field Names

New Member

i'm using transact to group logon events on windows by Logon_ID. On Windows 10, there's also a Linked_Logon_ID that links to a Logon_ID. Is it possible to join these events somehow (without renaming a field and doing another transact)?

0 Karma


You can do something like (for the sake of the example I am going to assume your field names are Linked_Logon_ID and Logon_ID) ...|eval Shared_Logon_ID=case( searchmatch("Linked_Logon_ID") , Linked_Logon_ID , searchmatch("Logon_ID") , Logon_ID) | transaction Shared_Logon_ID ...Both types of events will now have the common field name and will be grouped together by transaction. Hope this helps.

0 Karma


Please edit your post to provide details on the specific events to be connected, what the keys are, and so on, including your current SPL. Use the code button "101 010" to mark the code, so the splunk web spider will not eat it. (other methods include putting four spaces before each line and a blank line before and after, or surrounding it by grave accents (the one under the tilde on an american keyboard).

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!


Or Learn More in Our Blog >>