How do you move fields from one event to another?

pc1234 — Sun, 02 Dec 2018 18:24:48 GMT

i have events that contain the following.

host sourcetype value1 value2
100 log-c .60
100 log-d .75
100 log-retention-c 1
100 log-retention-d 2
100 cpuload .4

i want to combine the events to the following:

host sourcetype value1 value2
100 log-c .60 1
100 log-d .75 2
100 cpuload .4

The only source type that requires this are those beginning with log. I need value1 or value2 in the same event to calculate a status based on the values.

Note: Sorted by source type, there are no intervening source types between log% and log-retention%.

Any assistance is appreciated.

Best Regards,

Re: How do you move fields from one event to another?

HiroshiSatoh — Mon, 03 Dec 2018 05:06:09 GMT

I would like you to explain the situation more concretely

As a general story…
The way to combine the fields of another event into the event is below.

(Efficient method)
sourcetype=sourcetype_a OR sourcetype=sourcetype_b  | stats latest(*) AS * BY your_key

(Easy way)
sourcetype=sourcetype_a | join type=inner your_key
[search sourcetype=sourcetype_b  | dedup your_key| table your_key,  fields_1, ields_2,fields_other]

topic Re: How do you move fields from one event to another? in Dashboards & Visualizations

How do you move fields from one event to another?

Re: How do you move fields from one event to another?