Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

combining fields from two log entries which have a common id that is named differently

$
0
0
Base, How can I combine two log entries that share a common ID when the field name of the ID is different between both entries? Currently I'm using re-name to change my field names into strings that don't contain "-" (eval seems to hate "-"), > rename v.my-very-long-field-name.rid AS rid then eval to give the unique field names a single name, and transact:> eval request_id=if(isnull(rid), req, rid)>transaction request_id | Last thing: I table values from both log entries. Seems like it should work great... but... it doesn't. I end up with table entries containing values from 1 log entry or the other, not both. Help me Obi Wan...

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>