https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203610#M59143 <P>First you'll need to search for events from both sourcetypes, then normalize your Node field to match the NodeID field, and then do whatever you're actually trying to do with the data:</P> <PRE><CODE> sourcetype=eventsWithNodeID OR sourcetype=eventsWithNode | rex field=Node "0*(?&lt;tempNodeID&gt;\d+)$" | eval mergedNodeID = case(sourcetype="eventsWithNodeID", NodeID, sourcetype="eventsWithNode", tempNodeID) | stats values(foo) as foo max(bar) as bar by mergedNodeID </CODE></PRE> <P>Check out the excellent March 2016 Virtual.conf talk by @sideview on this very subject available at <A href="http://wiki.splunk.com/Virtual_.conf">http://wiki.splunk.com/Virtual_.conf</A></P> Sun, 12 Jun 2016 19:57:05 GMT martin_mueller 2016-06-12T19:57:05Z https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203608#M59141 <P>I have two fields (different sourcetypes) that have a Node ( for example: node001) and NodeID (example: 1)</P> <P>How would i extract Node to NodeID dealing with the leading zeros?</P> Sun, 12 Jun 2016 18:46:34 GMT https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203608#M59141 jrich523 2016-06-12T18:46:34Z https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203609#M59142 <P>Hi. Something like:</P> <PRE><CODE>sourcetype=X OR sourcetype=Y | rename Node* as * </CODE></PRE> <P>Can be an option.</P> Sun, 12 Jun 2016 19:50:38 GMT https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203609#M59142 changux 2016-06-12T19:50:38Z https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203610#M59143 <P>First you'll need to search for events from both sourcetypes, then normalize your Node field to match the NodeID field, and then do whatever you're actually trying to do with the data:</P> <PRE><CODE> sourcetype=eventsWithNodeID OR sourcetype=eventsWithNode | rex field=Node "0*(?&lt;tempNodeID&gt;\d+)$" | eval mergedNodeID = case(sourcetype="eventsWithNodeID", NodeID, sourcetype="eventsWithNode", tempNodeID) | stats values(foo) as foo max(bar) as bar by mergedNodeID </CODE></PRE> <P>Check out the excellent March 2016 Virtual.conf talk by @sideview on this very subject available at <A href="http://wiki.splunk.com/Virtual_.conf">http://wiki.splunk.com/Virtual_.conf</A></P> Sun, 12 Jun 2016 19:57:05 GMT https://community.splunk.com/t5/Splunk-Search/relating-fields-with-eval/m-p/203610#M59143 martin_mueller 2016-06-12T19:57:05Z