About armahalma

armahalma · ‎01-17-2022

Thanks, but as mentioned I could not use pipe char "|" as part of the search as it's limited by the eventtype definition. https://docs.splunk.com/Documentation/Splunk/7.3.1/Admin/Eventtypesconf Using "transaction" does provide the field I need as it groups the related events, but I need the field from the second event to be there on the first event permanently so when we do search it would appear as part of the result - so I can't really use "transaction" in this case. Ideally the two events should have been ingested as a single event so we won't have this problem, but that's not the case.

armahalma · ‎01-12-2022

Is there a way to add a field to an event from a different event assuming they have a common key using a simple search (without using pipe)? The reason being the resulting event will need to be tagged via event type (which doesn't allow complex search) so it can be included as part of a data model. For example, Event 1 - field A (common key): ABC, field B: Sunny Event 2 - field A (common key): ABC, field C: Morning Resulting Event 1: field A: ABC, field B: Sunny, field C: Morning The final event will then be tagged so it can be included in the data model. Appreciate any advice/suggestion.

Posts	2
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎01-12-2022

Online Status	Offline
Date Last Visited	‎01-17-2022 06:27 PM

How to add field from different event for data mod...

Re: How to add field from different event for data...

How to add field from different event for data mod...