Transaction Searching: Unifying Field Names

Solution

Typically, you can join transactions with common fields like:

          ... | transaction username

But when the username identifier is called different names (login, name, user, owner, and so on) in different data sources, you need to normalize the field names.

If sourcetype A only contains field_A and sourcetype B only contains field_B, create a new field called field_Z which is either field_A or field_B, depending on which is present in an event. You can then build the transaction based on the value of field_Z.

          sourcetype=A OR sourcetype=B
          | eval field_Z = coalesce(field_A, field_B)
          | transaction field_Z

Variations

Above we invoked coalesce to use whichever field was present on an event, but sometimes you will need to use some logic to decide which field to use in unifying events. eval’s if or case functions may come in handy.