Splunk Search
Highlighted

field fillnull with values from correlated events

New Member

Hi.<br>There are number of events that contain dynamic values of TicketST and JsessionST fields.<br>But there&#39;s always one event that contains unique combination of TicketST-JsessionST pair values.<br>Is it possible to map events based on TicketST par

Tags (3)
0 Karma
Highlighted

Re: field fillnull with values from correlated events

SplunkTrust
SplunkTrust

What is your question? We need more than just a screen shot to know what your problem is.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: field fillnull with values from correlated events

SplunkTrust
SplunkTrust

Without much information, I'm assuming you want to populate field JsessionST with JsessionST value of different row with same TicketST field value, and each JsessionST value is associated with only one TicketST field value. Please provide more details if these assumptions are wrong. If not, give this a try

index=_* OR index=* sourcetype=nginx | table _time Method TicketST JsessionST | eventstats values(JsessionST) as JsessionST by TicketST

Also, IMO, you don't need to include index=_* in your search as there should be no data in internal indexes for sourcetype nginx. Check that.

View solution in original post

0 Karma
Highlighted

Re: field fillnull with values from correlated events

New Member

Thanks a lot! This is exactly what was required.

0 Karma