I want to display from two sources from one Index with different fields via a key value in the result fields from both sources. is that possible?
Example:
source 1 contains the following fields: Id, function, serial number,...
source2 contains these fields: Id, leasing_end, leasing_start;....
The ID field contains the key value.
The result should show which devices on a certain date have leasing end divided by function
Translated with www.DeepL.com/Translator
@egt,
Another way is to use stats
index="your index" (source="source1" OR source="source2") |fields id,function,serial_number, leasing_end, leasing_start
|stats values(*) as * by id
Now you should be able to do further processing/checks on the data.
e.g.
Events(dummy)
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
Final result
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
|stats values(*) as * by id
@egt,
Another way is to use stats
index="your index" (source="source1" OR source="source2") |fields id,function,serial_number, leasing_end, leasing_start
|stats values(*) as * by id
Now you should be able to do further processing/checks on the data.
e.g.
Events(dummy)
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
Final result
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
|stats values(*) as * by id
you can do that with a join - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join