Splunk Search

How to connect two transaction commands from 3 sources linked by 2 fields?

e_psilo_n
New Member

I want to track a single transaction through three different events.

Event A and Event B share a common field f1 which links the events as a transaction
Event B and Event C share a common field f2 which links the events as a transaction
Event A does not contain f2.
Event C does not contain f1

I have a search like the following

event=A OR event=B OR event=C
| transaction f1 maxspan=2s keeporphans=true keepevicted=true
| transaction f2 maxspan=2s
| table f1 f2 other_field_unique_to_A other_field_unique_to_B other_field_unique_to_C

Events of type A and B are joined exactly how I like - on field f1. Their unique fields appear together on the same line of the output table.
In the output table, I can see all the events of type C, but none of them are ever joined in to the corresponding transactions of type A and B.

What can be done here?

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

event=A OR event=B OR event=C
| eventstats values(f1) as f1_temp by f2 | eval f1=coalesce(f1,f1_temp)
| eventstats values(f2) as f2_temp by f1 | eval f2=coalesce(f2,f2_temp)
| stats values(uniqfield1) as uniqfiel1 values(uniqfield2) as uniqfield2.... by f1 f2
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...