Transacting Events Across Different Field Names

[joshwilczek]

i'm using transact to group logon events on windows by Logon_ID. On Windows 10, there's also a Linked_Logon_ID that links to a Logon_ID. Is it possible to join these events somehow (without renaming a field and doing another transact)?

[brendanmatthews]

You can do something like (for the sake of the example I am going to assume your field names are Linked_Logon_ID and Logon_ID) ...|eval Shared_Logon_ID=case( searchmatch("Linked_Logon_ID") , Linked_Logon_ID , searchmatch("Logon_ID") , Logon_ID) | transaction Shared_Logon_ID ...Both types of events will now have the common field name and will be grouped together by transaction. Hope this helps.

[DalJeanis]

Please edit your post to provide details on the specific events to be connected, what the keys are, and so on, including your current SPL. Use the code button "101 010" to mark the code, so the splunk web spider will not eat it. (other methods include putting four spaces before each line and a blank line before and after, or surrounding it by grave accents (the one under the tilde on an american keyboard).