Matching a timestamp from two index events.

[danfinan]

Hi guys,

I have two indexes with two different types of syslogs. Both logs contain a common field (username) and I would like to be able to pair them up to form a single event/result.

Could someone please advise the best way to approach this task? I assume I would need to form a common field between the two event types but how would I then display the common field alongside independent fields from both indexes?

I hope that makes sense, struggled to explain that one!

Thank you!

[jacobpevans]

Greetings @danfinan,

The efficient way to do this is to use stats. Here's some sample data:

index1

username    field1
User1        abc
User2        def
User3        ghi
User4        -
User5        -

index2

username    field2
User1        xyz
User2        nop
User3        -
User4        klm
User5        -

Here's a run-anywhere search that will transform as you described:

           | makeresults | eval username="User1", field1="abc"
| append [ | makeresults | eval username="User1", field2="xyz" ]
| append [ | makeresults | eval username="User2", field1="def" ]
| append [ | makeresults | eval username="User2", field2="nop" ]
| append [ | makeresults | eval username="User3", field1="ghi" ]
| append [ | makeresults | eval username="User4", field2="klm" ]
| append [ | makeresults | eval username="User5" ]
| stats values(field1) as field1 values(field2) as field2 by username

And the output will look like this:

username    field1   field2
User1        abc      xyz
User2        def      nop
User3        ghi      -
User4        -        klm
User5        -        -

Cheers,
Jacob