From Splunk Wiki
Assume you have two sets of data.
The raw events as seen by Splunk are as follows.
Raw dataset 1, sourcetype=names
12:03:05 ID=1 Name=Alice 12:06:33 ID=2 Name=Billy 12:08:12 ID=3 Name=Chuck 12:09:55 ID=4 Name=Danni
Raw dataset 2, sourcetype=types
12:04:07 ID=1 Type=Aardvark 12:08:15 ID=2 Type=Bumblebee 12:09:26 ID=3 Type=Cat 12:09:35 ID=4 Type=Dragon
Table view, dataset 1, sourcetype=names
sourcetype=names | table *
Table view, dataset 2, sourcetype=types
sourcetype=types | table *
Searches using that data set
The Easy Way, using OR between search terms
A simple search using "OR" will put the two sets of data into the same output.
sourcetype=names OR sourcetype=types | table *
Notice some shortcomings
- It is ordered by _time.
- Fixable by adding
| sort <fieldname>to the end.
sourcetype=names OR sourcetype=types | sort ID
- Fixable by adding
- It has empty fields.
- Fixed in various ways below.
- Events with matching ID fields aren't "together."
- Also fixed in various ways below.
Putting events with matching ID fields together
Using stats to combine these is the fastest way [see note 1]. You do need to know a bit about each field, though.
sourcetype=names OR sourcetype=types | stats values(Name) as Name, values(Type) as Type, earliest(_time) as StartTime, latest(_time) as EndTime BY ID | table *
Note 1) Stats can split up a problem and have many indexers each work on their own part to the problem and doing the majority of the work. It then combines the separate results together at the end, a relatively easy and fast problem. If you have only a single indexer, the different between it and, say, the transaction command is minimal. With a larger environment, the difference in speed can be very large.
Transaction is conceptually simpler than the results you get out of stats when your objective is to "combine" events together. To use transaction you can use a field to group them together on (ID in this case), and in addition you can specify specific search terms to use to define when to start the grouping and when to end the grouping and start a new group.
sourcetype=names OR sourcetype=types | transaction ID | table *
| table * at the end, you could see all transaction really did was use the first _time field of each group and smash the rest of the fields together.
12:03:05 ID=1 Name=Alice 12:04:07 ID=1 Type=Aardvark
12:06:33 ID=2 Name=Billy 12:08:15 ID=2 Type=Bumblebee
12:08:12 ID=3 Name=Chuck 12:09:26 ID=3 Type=Cat
12:09:55 ID=4 Name=Danni 12:09:35 ID=4 Type=Dragon
Because of that, each of the combined events has both a Name and a Type.
If your items don't match perfectly, like if there are occasional names that have no type that matches the ID, then on those combined events those particular fields will just be empty.
Some things to note:
- The first Time is assigned as the _time
- The duration was calculated and included for each result.
- A new field "eventcount" was also created, which in the above case is always 2 because there were two events smashed into one each time.