I've been searching how to join, but every example that I apply seems to be wrong.
I've got referents type of log:
app=my_app_name INFO controller=MyController method=myMethod transaction=999
app=my_app_name INFO controller=MyOtherController transaction_id=999
app=my_app_name INFO controller=CheckoutController params[transaction_id]=999
As you can see, I always have the transaction id in different keys.
So I'm trying to join like this:
index=my_app_name | join "params[transaction_id]" [ search index=my_app_name transaction_id ] | fields controller
But like i said, it seems not to be working, because I've always got some result rows that don't make sense, like:
app=my_app_name INFO controller=CheckoutController order_id=99
Try this:
... | rex "params\[transaction_id\]=(?<transaction_id>\d+)" | stats values(*) AS * by transaction_id
Here's a pretty good writeup to get you started on not joining at all: http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-joi...
Try this:
... | rex "params\[transaction_id\]=(?<transaction_id>\d+)" | stats values(*) AS * by transaction_id