extracted field propagation across related events

[twistedsixty4]

Hey all,
I have a event log that i have to generate reports off of for the BI team where i work. the problem i keep running into is that the different event types log different set of information all tied to a unique event_id, but i need to have one field of a specific event type tied to all the other events with the same id.

example:
time event_id Node user status event_type
18534564.56 05178 HIL-DEV01 not_reporting alert
18640234.9 05179 ROV-HOST01 disk_space_low alert
19538754.13 05178 Hal9001 closed

in this example i want to assign node HIL-DEV01 across all events with the ID of 05178. I have tried to do this with transactions, but i have found that i lose unique time values for events inside the transaction.

is it possible to do this with eval? or does anyone have an idea of what to do? if you need more info just let me know.

[somesoni2 · Accepted solution]

Give this a try

your base search | eventstats first(Node) as Node by event_id 

[twistedsixty4]

you are a godsend sir, this worked great!

[strive]

Try this and see if this is hat you need

Some Search Terms | stats values(time) as Timers first(Node) as Node values(status) as Statuses values(event_type) as Events by event_id