Splunk Search

combine events based on a common field

quirkyUnicorn28
Loves-to-Learn

I have data being pushed onto Splunk in JSON format. What I am trying to do is combine events. For example, 2 events that have a common id should be merge onto one. So I have the following data:

{ studentid: 1234
  studentGrade:{
  Math:{ grade: "A"}
  }
}

{ studentid: 1234
  studentGrade:{
  Physics:{ grade: "C"}
  }
}

 

As seen, I'd like to create the 2 events into 1 based on the studentId. To end up with a result like the following:

Student IdMathPhysics
1234AC

 

Thank you in advance, very new in Splunk and I found it difficult to merge events based on other requests Ids. 

Labels (3)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...