Hi, I have a log that tracks user changes to a specific field in a form. The process is as follows: 1. The user accesses the form, which generates a log event with "get" eventtype along with the current value of field1. This can occur several times as the user refreshes the page, or through code behind the scenes that generates an event based on how long the user stays on the page. 2. The user fills in the form and hits submit, which logs an event with "update" eventtype. Here's a simplified list of events: _time,         eventtype,          sessionid,         field1 10:06         update                  session2           newvalue3 10:05         get                          session2           newvalue2 09:15         update                  session1           newvalue2 09:12         get                          session1           newvalue1 09:10         get                          session1           newvalue1 09:09         update                  session1           newvalue1 09:02         get                          session1           oldvalue1 09:01         get                          session1           oldvalue1 08:59         get                          session1           oldvalue1 I'm looking to get the last value of field1 before each "update" eventtype. Basically I'd like to track what the value was before and what it was changed to, something like: _time,              Before,                      After 10:06               newvalue2              newvalue3 09:15               newvalue1              newvalue2 09:09               oldvalue1                newvalue1 I've tried this with a transaction command on the session, but I run into issues with the multiple instances "get" events in the same session, which makes it a little convoluted to extract the running values of field1.  I also tried this with a combination of the latest(field1) and earliest(field1), but then this misses any updates that might take place within the session - we sometimes have users who change the value and then change it back. I'd like to capture those events as well.   Does anyone have any tips on how to get this accomplished? Thanks! ... View more

Hi, I'm wondering if it's possible to do an outer/left join two tables on two fields. I have two indexes with the following data: Index1: col1 col2 123 abc 456 def Index2: col1 col2 col3 123 abc xyz Desired results: col1 col2 col3 123 abc xyz 456 def Here's my search: index=index1 |join type=outer col1, col2 [search index=index2 |fields col1, col2, col3] |table col1, col2, col3 The results I get are inconsistent. It seems almost as if Splunk is going the outer join on the two columns independently, so I get more results than I need. If I remove the "type=outer", making it an inner join, I get the below results, so I know the join works for the inner: col1 col2 col3 123 abc xyz Thanks, AP ... View more