How can i Search field from two different file source and merge in to a single table ?

JIthesh_Kumar — Wed, 10 Jul 2024 09:55:57 GMT

Bellow mentioned table is an example which having same index and sourcetype, but it have a different source.

I need to search a field from 1st file and the result should be a combination of fields from file 1 and 2.

File 1

File 2

consider i am running a search where T1_Fld 1=AAB then the result table form should be like below.

Output

Re: How can i Search field from two different file source and merge in to a single table ?

bowesmana — Wed, 10 Jul 2024 21:55:36 GMT

Use stats to combine them

index=data_set1 OR index=data_set2 | stats values(*) as * by Domain

Here uses values(*) as * to collect all fields from both data sources against their common field Domain.

You can filter then what you do or don't want, e.g. after the above, do

| where T1_Fld 1="AAB"