Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to combine different types of events from different data sources into one event?

$
0
0
Hello I have three different data sources (so 3 different types of events) DataSource_1: Event_Number Ticket DataSource_2: Event_Number Create_Event_Date DataSource_3: Ticket Create_Ticket_Date I would like to get one event which has: Ticket Create_Ticket_date Create_Event_Date Is it possible to build a search which shows this as one event, taking also into account possible new completely different data sources (e.g. DataSource_4)? I was trying transaction (not efficient), lookups (which I created from two different sources and use inputlookup populated to the 3rd one. In the search, there was some specification to those 3 data sources. Doing a lot of reports I would always need to take into account this part. Thank you

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>