Splunk Search

Joining to another sourcetype based on field from one log message and correlating to a different log message in the same log

danoconnl
Explorer

log a
5/14/2015 1pm [1150] <message><trnid>1001</trnid></message>
5/14/2015 1:01pm [1150]elapsed time = 1100

log b
5/14/2015 1pm, trnid=1001, 1200

so log a and b are linked on transaction id, and the two lines in log a are linked by the 1150.

I've got code that will pull the trnid out of the message, I just don't know how to link the two together and then use it to compare the elapsed time in log a to the third number in log b

Dan

Tags (2)
0 Karma
1 Solution

aholzer
Motivator

Depending on what your end goal is you should use either of the following commands:
- Transaction
You'd have to transact on log a's ID, then transact with the trnid to log b. You'd end up with a single event with all three log lines aggregated, and all the fields from all three events would be available in your new aggregated event.

Your search would look something like this:

<base search for both log a and log b> | transaction <log a's id> keeporphans=true | transaction trnid

Make sure to use as many parameters/attributes in each of the transaction commands, because transaction can be an expensive command. Look into things like maxspan, maxpause, startswith, etc

OR
- Join
Basically you'd have to treat every part as a database table and join them separately. You'd end up with all the fields from all the events under a single event, but you would not have all the _raw messages from each event. Also note that join uses subsearches; subsearches are not efficient and have a default 10k limit to resulting events.

Your search would look something like this:

<your base search for log a type 1 events > | join <log a's id> [search <your base search for log a type 2 events> | join trnid [search <base search for log b>

Hope this helps

--- EDIT: fixed typos ---

View solution in original post

aholzer
Motivator

Depending on what your end goal is you should use either of the following commands:
- Transaction
You'd have to transact on log a's ID, then transact with the trnid to log b. You'd end up with a single event with all three log lines aggregated, and all the fields from all three events would be available in your new aggregated event.

Your search would look something like this:

<base search for both log a and log b> | transaction <log a's id> keeporphans=true | transaction trnid

Make sure to use as many parameters/attributes in each of the transaction commands, because transaction can be an expensive command. Look into things like maxspan, maxpause, startswith, etc

OR
- Join
Basically you'd have to treat every part as a database table and join them separately. You'd end up with all the fields from all the events under a single event, but you would not have all the _raw messages from each event. Also note that join uses subsearches; subsearches are not efficient and have a default 10k limit to resulting events.

Your search would look something like this:

<your base search for log a type 1 events > | join <log a's id> [search <your base search for log a type 2 events> | join trnid [search <base search for log b>

Hope this helps

--- EDIT: fixed typos ---

danoconnl
Explorer

Thanks for the help, figured it out

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...