Hey there,
I currently have a query that compares a field to two sources. What I want is to be able to only keep fields with the same value across the events.
Here's what I have:
index=* source=src1.log OR source=src2.log | eventstats dc(source) as source_count by FIELD_NAME | where source_count = 1
The above works, but keeps the unique FIELD_NAME values. Is there a way to do the opposite?
Ex:
src1.log
FIELD_NAME = name1
FIELD_NAME = name2
src2.log
FIELD_NAME = name3
FIELD_NAME = name2
RESULT EVENTS
FIELD_NAME = name2
Thank you in advance!
Replace the 1 with a 2 to get FIELD_NAME
values that have two distinct source
values, ie exist in both sources.
Replace the 1 with a 2 to get FIELD_NAME
values that have two distinct source
values, ie exist in both sources.