Combine 2 events by a matching field without using join.

[anooshac]

Hi all,

I have 2 events present in a source type, with different data. There is one field which has same data in both the events but the field names are different. Can anyone suggest a method other than JOIN to combine 2 events? I tried combining the fields by coalesce command, once i combine them i was not able to see the combined fields.

I want to combine the events and do some calculations.

[gcusello · Accepted solution]

Hi @anooshac,

you have to coalesce the key fields and then correclate them using stats:

if the fields to correlate are field1 and field2 and the fields to display are field3 and field4 from the type1 and field5 from type2

index=your_index sourcetype=your_sourcetype type IN (type1, type2)
| eval key=coalesce(field1,field2)
| stats 
     values(field3) AS field3
     values(field4) AS field4
     values(field5) AS field5
     BY key

Cao.

Giuseppe

[gcusello]

Hi @anooshac ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉