Archive
Highlighted

union search with same field from different sourcetype

New Member

I have two sources as below:
source x:

CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01 | 1 | 2019/02/02 | 2 |
source y:

ID,UserName,.......
1 | Tom
2 | Jack

my expected output:
CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01| Tom |2019/02/02 | Jack |

do you have any idea? Thanks in advance.

Tags (2)
0 Karma
Highlighted

Re: union search with same field from different sourcetype

Legend

Hi lllidan,
try something like this:

index=my_index (sourcetype=sourcetypeA  OR sourcetype=sourcetypeB)
| rename ChangeUser AS ID
| stats values(CreateTime) AS CreateTime values(CreateUser) AS CreateUser values(ChangeTime) AS ChangeTime values(UserName) AS UserName BY ID
| fields - ID
| rename UserName AS ChangeUser
| table CreateTime CreateUser ChangeTime ChangeUser

If you have more fields to add, use the values(fields) AS field approach.

Ciao.
Giuseppe

0 Karma
Highlighted

Re: union search with same field from different sourcetype

New Member

it seems doesn't work, the query values(fields) can only extract the value of fields, but can't show the relationship between two sourcetype, when the field ChangeUser is "2" , it must mapping to sourceB and find ID equal 2, and got the UserName=Jack=ChangeUser=2

0 Karma