I want to tie together 2 events at index time the same way I would tie them together at search time using the transaction
command.
So for example I have this..
Mon Jul 11 13:57:29 2016
RW(16,148936) report:
RW: DBdelete return -1; fname=CM,key=01*123/456-7890
Mon Jul 11 13:57:29 2016
RW(16,148936) report:
Delete CM,'01*123/456-7890' failed
I created a field called key
which will grab 01*123/456-7890
from both events and I can tie them together at search time using transaction.. index=sql | transaction Key
.. But I want to do this at index time instead so the end user does not have to keep tieing them together with the transaction command each time they do a search
What a bummer. I guess I could go that route or just use the transaction
command as a saved search so they don't have to type it in each time
What a bummer. I guess I could go that route or just use the transaction
command as a saved search so they don't have to type it in each time
Or as a macro. You can also look at option of summary indexing just in case users don't need this data in real-time.
This is what I'll do! I'm willing to wait a half hour if it means I can get a performance boost at search time, thanks!