Fetch values from multiple lines and combine - splunk

Question

We forwarded app logs to splunk from different host and different sources.
Thread1 requestId=aUniqueID1 table=Table1
Thread1 size=2gb
Thread2 requestId=aUniqueID5 some other log
Thread1 requestId=aUniqueID1 some other log
Thread2 size=5gb
Thread1 requestId=aUniqueID2 table=Table2
Thread1 size=4gb
Thread1- requestId=aUniqueID3 table=Table3
Here I want to a table of request Id and size
aUniqueId1 2gb
aUniqueId2 4gb
aUniqueID5 5gb
Basically, thread name stays the same per host, but the same thread will be reused once a request is completed.
Can someone help write a Splunk query?
When a request comes, a log can be identified with thread name (Thread1,Thread2,etc)
Basically for a transaction, most log statements have requestId and I know the start and end times, thus I know the size within that time range (by host and sourcetype and thread name)

Answer 1

Here is a run-anywhere example of how to do that.
| makeresults | eval data="Thread1 requestId=aUniqueID1 table=Table1
Thread1 size=2gb
Thread1 requestId=aUniqueID1 some otherlog
Thread1 requestId=aUniqueID2 table=Table2
Thread1 size=4gb
Thread1 requestId=aUniqueID3 table=Table3" | eval data=split(data,"
") | mvexpand data | eval _raw=data
```Everything above sets up test data. Omit when using live data```
```Combine requestId and size lines```
| transaction startswith="requestId" endswith="size"
```Parse the results```
| extract kvdelim=" ", pairdelim="="
```Display request ID and corresponding size```
| table requestId size