Splunk Search

how to extract fields from one event in a log file and append them to other events in same log?

blee_i365
Explorer

My log files:

=============

2011-06-05 05:11:23.234 Program Version 10.02.2345

2011-06-05 05:11:23.239 event 1

2011-06-05 05:11:23.250 event 2

...

...

2011-06-05 10:10:13.150 event 20000

2011-06-05 10:10:13.151 event 20001

=============

I'd like to include a "ProgramVersion" field with value "10.02.2345" in all events contained in the same log file. With field extraction I can easily create this field and assign it the value 10.02.2345. However this field is not associated with subsequent events. Is there a way to achieve this?

Tags (3)
1 Solution

mw
Splunk Employee
Splunk Employee

Ah, gotcha. Something like this maybe:

source=mysource.log event=* | appendcols [search source=mysource.log ProgramVersion=* | fields ProgramVersion]

View solution in original post

blee_i365
Explorer

Thank you mv. That gets what I need.

0 Karma

mw
Splunk Employee
Splunk Employee

Ah, gotcha. Something like this maybe:

source=mysource.log event=* | appendcols [search source=mysource.log ProgramVersion=* | fields ProgramVersion]

blee_i365
Explorer

Hi mv, thanks for the reply. Unfortunately that post doesn't seem to do what I want, which is when I search for "event 20001" for example (or any event within the same log file) I want it to also include a field called ProgramVersion containing value 10.02.2345.

Another way to put this is there is information of interest at the beginning of my log file, and I want this information to be visible to all events recorded in this log.

Thanks in advance.

0 Karma

mw
Splunk Employee
Splunk Employee
0 Karma
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...