Splunk Search

Transacting Events Across Different Field Names

joshwilczek
New Member

i'm using transact to group logon events on windows by Logon_ID. On Windows 10, there's also a Linked_Logon_ID that links to a Logon_ID. Is it possible to join these events somehow (without renaming a field and doing another transact)?

0 Karma

brendanmatthews
Explorer

You can do something like (for the sake of the example I am going to assume your field names are Linked_Logon_ID and Logon_ID) ...|eval Shared_Logon_ID=case( searchmatch("Linked_Logon_ID") , Linked_Logon_ID , searchmatch("Logon_ID") , Logon_ID) | transaction Shared_Logon_ID ...Both types of events will now have the common field name and will be grouped together by transaction. Hope this helps.

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Please edit your post to provide details on the specific events to be connected, what the keys are, and so on, including your current SPL. Use the code button "101 010" to mark the code, so the splunk web spider will not eat it. (other methods include putting four spaces before each line and a blank line before and after, or surrounding it by grave accents (the one under the tilde on an american keyboard).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...