Splunk Search

Transacting Events Across Different Field Names

New Member

i'm using transact to group logon events on windows by Logon_ID. On Windows 10, there's also a Linked_Logon_ID that links to a Logon_ID. Is it possible to join these events somehow (without renaming a field and doing another transact)?

0 Karma


You can do something like (for the sake of the example I am going to assume your field names are Linked_Logon_ID and Logon_ID) ...|eval Shared_Logon_ID=case( searchmatch("Linked_Logon_ID") , Linked_Logon_ID , searchmatch("Logon_ID") , Logon_ID) | transaction Shared_Logon_ID ...Both types of events will now have the common field name and will be grouped together by transaction. Hope this helps.

0 Karma


Please edit your post to provide details on the specific events to be connected, what the keys are, and so on, including your current SPL. Use the code button "101 010" to mark the code, so the splunk web spider will not eat it. (other methods include putting four spaces before each line and a blank line before and after, or surrounding it by grave accents (the one under the tilde on an american keyboard).

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...