COmpare or join 2 fields to 3rd output

jerinvarghese — Sat, 06 Mar 2021 14:55:31 GMT

HI All,

Need help in comparing 2 fields or join 2 values to build a table for another 2 field.

CODE 1:

index=opennms "Cisco-WLC-AP-DOWN/AP*" | table AP_NAME, Time,downtime,

OUTPUT 1:

CODE 2:

index=moogsoft_e2e | table AP_NAME, Time,Ticket_ID,

OUTPUT 2:

Expected final output Table :

I want both AP_NAME & Time to match the Ticket_ID & downtime.

Re: COmpare or join 2 fields to 3rd output

richgalloway — Sat, 06 Mar 2021 17:24:49 GMT

Try this

(index=opennms "Cisco-WLC-AP-DOWN/AP*") OR index=moogsoft_e2e | stats values(*) as * by AP_NAME, downtime | table AP_NAME, Time,Ticket_ID, downtime