Splunk Search

How do I create a transaction when not all fields are present?

mayakulkarni
New Member

Hi!

I am a Splunk beginner and have the following question.

I have some events I would like to transact, but not all field values are present in all events. E.g:

Event1: cookie, ip
Event2: c_ip (value is same as ip field in event1)
Event3: client_ip (value same as ip field in event1)

I want events that have different values for the field cookie, but the same IP to be put into a different transaction, so this is why I cannot just rename the ip fields and transact on the ip.

Thanks!

0 Karma

sundareshr
Legend

You need the coalesce command. Like this

... | eval ip=coalesce(ip, src_ip, client_ip) | transaction ip 

http://blogs.splunk.com/2014/03/21/search-command-coalesce/

0 Karma

mayakulkarni
New Member

thanks, but one more questioN: I can see how this will work for the ip fields I have, but will this help for transacting based on a unique cookie and ip pair? my situation is as follows:

event1: cookie=sugar, ip=1.0
event2: c_ip=1.0
event3: client_ip=1.0

event4: cookie=chocolate, ip=1.0
event5: c_ip=1.0
event6: client_ip=1.0

in this scenario, i want events 1-3 to be transacted together, and events 4-6 to be transacted together

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...