Splunk Search

How i merge multiple events based on the same value in a field?

leonl_0
Observer

I currently have events that include load times and events that include header colour for my app. These events both have the user's session id. How do I join the two events based on session Id so i can see the load time based on header colour?

Query for Load time:

 

index="main" measurement_type=loadTime screen_class_name=HomeFragment

 

 Query for HeaderColour:

 

index=api_analytics sourcetype=api_analytics 
| `expand_api_analytics`
| search iri=home/header
| spath input=analytic path=session_id output=session_id

 

Labels (2)
0 Karma

leonl_0
Observer

If i use the following command, it truncates everything in the second query so that I only have one unique value for every other fields

index=main measurement_type=loadTime screen_class_name=HomeFragment
| join sessionId [search index=api_analytics sourcetype=api_analytics
| `expand_api_analytics`
| search iri=home/header
| spath input=analytic path=session_id output=sessionId]

 

0 Karma
Get Updates on the Splunk Community!

Everything Community at .conf24!

You may have seen mention of the .conf Community Zone 'round these parts and found yourself wondering what ...

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...