Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

How to consolidate events that have an ID field with different names across multiple sourcetypes?

$
0
0
Hi all. I have almost 20 different sourcetypes. Field names in sourcetypes are different and I don't have the same in more than 1 sourcetype. Each sourcetype has a "slice" of a record using an ID, but this ID has different names across the sourcetypes. I mean: sourcetype: example1 ID Field: ex1_id ex1_id: 5555 ex1_type: Tool sourcetype: example2 ID Field: ex2_id ex2_id: 5555 ext2_name: SN56616 sourcetype: example3 ID Field: ex3_id ex2_id: 5555 ext3_kind: none I need to search in all sourcetypes and create a resulting table that looks like: ID | ext1_type | ext2_name | ext3_kind 5555 | Tool | SN56616 | none I tried to create a field alias by sourcetype to the appropriate `ID Field name` to use the same name like `ID` to facilitate the search. I don't how proceed, `transaction`? `join`? Thanks!

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>