TIPS & TRICKS

Transaction Searching: Unifying Field Names

Splunk By Splunk October 12, 2012

EXCERPT FROM “EXPLORING SPLUNK: SEARCH PROCESSING LANGUAGE (SPL) PRIMER AND COOKBOOK”. Kindle/iPad/PDF available for free, and hardcopy available for purchase at Amazon.

Problem

You need to build transactions from multiple data sources that use different field names for the same identifier.

Solution

Typically, you can join transactions with common fields like:

          ... | transaction username

But when the username identifier is called different names (login, name, user, owner, and so on) in different data sources, you need to normalize the field names.

If sourcetype A only contains field_A and sourcetype B only contains field_B, create a new field called field_Z which is either field_A or field_B, depending on which is present in an event. You can then build the transaction based on the value of field_Z.

          sourcetype=A OR sourcetype=B
          | eval field_Z = coalesce(field_A, field_B)
          | transaction field_Z

Variations

Above we invoked coalesce to use whichever field was present on an event, but sometimes you will need to use some logic to decide which field to use in unifying events. eval’s if or case functions may come in handy.

----------------------------------------------------
Thanks!
David Carasso

Splunk
Posted by

Splunk