Splunk Search

combine events based on a common field

quirkyUnicorn28
Loves-to-Learn

I have data being pushed onto Splunk in JSON format. What I am trying to do is combine events. For example, 2 events that have a common id should be merge onto one. So I have the following data:

{ studentid: 1234
  studentGrade:{
  Math:{ grade: "A"}
  }
}

{ studentid: 1234
  studentGrade:{
  Physics:{ grade: "C"}
  }
}

 

As seen, I'd like to create the 2 events into 1 based on the studentId. To end up with a result like the following:

Student IdMathPhysics
1234AC

 

Thank you in advance, very new in Splunk and I found it difficult to merge events based on other requests Ids. 

Labels (3)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...