If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in the right direction I would be grateful!
Thanks everyone for the help. Question I would like to group the multiple DSLAM_NODE_NAMES together instead of having to searching for them in the table. So maybe like the highest hit be at the top. Any thoughts? Below is what I have that is working for the first part.
| append [search index=poll_dslam sourcetype=poll_dslam_inventory
| fields CKTID_OR_TN, DSLAM_NODE_NAME, CODE4]
| stats last(DSLAM_NODE_NAME) as DSLAM_NODE_NAME, last(CODE4) as CODE4 by CKTID_OR_TN
| table CKTID_OR_TN, DSLAM_NODE_NAME, CODE4
| dedup CODE4, DSLAM_NODE_NAME
| rename CODE4 as "Closing Codes", CKTID_OR_TN as "BTN", DSLAM_NODE_NAME as "DSLAM CLLI"
Try this. Fields name for telephone number should be same in index 1 and 2. If not, just rename it using rename command.
index=Index 1 | append [ search index=Index 2 | fields telephone_number_field, device_name_field, resolution_code_field] | stats last(device_name_field) as device_name, last(resolution_code_field) as resolution_code by telephone_number_field
Thanks very much for the help! I do have one issue though. The telephone number and device name shows up and matches, however the resolution code does shows up at the top of table but doesn't display any of the data in the fields. Any thoughts?
index=Index 1 OR index=Index 2 | fields telephone_number_field, device_name_field, resolution_code_field | stats last(device_name_field) as device_name, max(resolution_code_field) as resolution_code by telephone_number_field