Splunk Search

combine events based on a common field

quirkyUnicorn28
Loves-to-Learn

I have data being pushed onto Splunk in JSON format. What I am trying to do is combine events. For example, 2 events that have a common id should be merge onto one. So I have the following data:

{ studentid: 1234
  studentGrade:{
  Math:{ grade: "A"}
  }
}

{ studentid: 1234
  studentGrade:{
  Physics:{ grade: "C"}
  }
}

 

As seen, I'd like to create the 2 events into 1 based on the studentId. To end up with a result like the following:

Student IdMathPhysics
1234AC

 

Thank you in advance, very new in Splunk and I found it difficult to merge events based on other requests Ids. 

Labels (3)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...