Practical Splunk Search Processing Language: A Guide for Mastering SPL Commands for Maximum Efficiency and Outcome

© Karun Subramanian 2020

K. SubramanianPractical Splunk Search Processing Languagehttps://doi.org/10.1007/978-1-4842-6276-4_4

4. Grouping and Correlating

Karun Subramanian¹  

(1)

Greater Minneapolis, MN, USA

 

When you collect your log data from multiple data sources such as network devices, servers, and applications, the need for correlating and grouping those logs may raise. For example, your application server log might store the transaction ID in the application server’s log files. If your application utilizes an external service, which is not uncommon, the transaction ID might appear on its log files. If you want to know the complete end-to-end activities of a particular transaction ID, you need to correlate your application server’s logs with ...