Hi guys,
I have two indexes with two different types of syslogs. Both logs contain a common field (username) and I would like to be able to pair them up to form a single event/result.
Could someone please advise the best way to approach this task? I assume I would need to form a common field between the two event types but how would I then display the common field alongside independent fields from both indexes?
I hope that makes sense, struggled to explain that one!
Thank you!
Greetings @danfinan,
The efficient way to do this is to use stats
. Here's some sample data:
index1
username field1
User1 abc
User2 def
User3 ghi
User4 -
User5 -
index2
username field2
User1 xyz
User2 nop
User3 -
User4 klm
User5 -
Here's a run-anywhere search that will transform as you described:
| makeresults | eval username="User1", field1="abc"
| append [ | makeresults | eval username="User1", field2="xyz" ]
| append [ | makeresults | eval username="User2", field1="def" ]
| append [ | makeresults | eval username="User2", field2="nop" ]
| append [ | makeresults | eval username="User3", field1="ghi" ]
| append [ | makeresults | eval username="User4", field2="klm" ]
| append [ | makeresults | eval username="User5" ]
| stats values(field1) as field1 values(field2) as field2 by username
And the output will look like this:
username field1 field2
User1 abc xyz
User2 def nop
User3 ghi -
User4 - klm
User5 - -
Cheers,
Jacob