Splunk Search

Struggling with a multi-log transaction

mgagliardi
Path Finder

I'm trying to establish a transaction. The information is in two different indexes, different sourcetypes, etc. Basically what I've got in index 1 is a bunch of XML-formatted Windows event log data...I'm able to successfully do the necessary search, run an spath on it to extract the field/value I need (a domain\username), etc. The other index contains pretty basic log data, including a field named "SlotID" that contains data formatted as domain\username. I'm also able to run a search successfully to grab that data. This is what the beginning of my search looks like:

host= (index=main sourcetype= Message=) OR (index=wineventlog EventID=800) | spath output=user path=Event.UserData.EventXML.param1 | eval lcuser=lower(user)

At that point if I go look at my search results I have all the data I need to get the transaction duration (which starts with the EventID=800 and ends with the log message). My problem is the common value resides in two differently-named fields (lcuser and SlotID). I have tried rename...but end up with only one event type "winning" (whichever one I rename last) and containing the new/renamed field). Same deal with eval to a new field...the last eval wins and the first eval no longer contains that field.

I'm lost and really hoping someone can lend a hand...been beating my head against the wall on this for the better part of 4 hours.

TIA!

1 Solution

mgagliardi
Path Finder

coltwanger's response was the (or at least a) correct answer, it worked for my use case.

View solution in original post

mgagliardi
Path Finder

coltwanger's response was the (or at least a) correct answer, it worked for my use case.

coltwanger
Contributor

Have you tried coalesce?

| eval combined=coalesce(lcuser, SlotID)

0 Karma

mgagliardi
Path Finder

Dude, you're a damn witch! That's got it 🙂 Thanks so much, you just ended my week on a positive note.

0 Karma

coltwanger
Contributor

Awesome! Have a great weekend 🙂

0 Karma
Get Updates on the Splunk Community!

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...