Splunk Search

blending field values with transactions for stats

twistedsixty4
Path Finder

Hey everyone,

I am trying to blend field values from subcategory events that are related by a key. I can group them together with a transaction, but when i try to stats the values into a report separated by their subcategory the fields don't stick. let me draw a mock table...

Catagory: OrderID: UserID: EmpID:
order_placed 10101 abc1234
processing 10101 5678910
shipped 10101 5678910

the regular logs have specific fields, but in the generated report i need individual lines for each catagory of event, but with all the related fields filled so it would look like this:

Catagory: OrderID: UserID: EmpID:
order_placed 10101 abc1234 5678910
processing 10101 abc1234 5678910
shipped 10101 abc1234 5678910

any help on this? i know i'm missing something here..

1 Solution

martin_mueller
SplunkTrust
SplunkTrust

So you essentially want to fill empty UserID and EmpID values by OrderID? Try something like this:

... | eventstats values(UserID) as UserID values(EmpID) as EmpID by OrderID | ...

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

So you essentially want to fill empty UserID and EmpID values by OrderID? Try something like this:

... | eventstats values(UserID) as UserID values(EmpID) as EmpID by OrderID | ...

twistedsixty4
Path Finder

this is perfect, i'm testing now, but it seems to fix my problems, thanks!

Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials (Episode 3)

Welcome back to Splunk Classroom Chronicles, our ongoing blog series that pulls back the curtain on Splunk ...

Operationalizing TDIR: Building a More Resilient, Scalable SOC

Optimizing SOC workflows with a unified, risk-based approach to Threat Detection, Investigation, and Response ...

Almost Too Eventful Assurance: Part 1

Modern IT and Network teams still struggle with too many alerts and isolating issues before they are notified. ...