I'm trying to combine 2 CSV files, where:
- test-ad has the field "EmailAddress" and "Enabled";
- "Composição das tribos - Relação funcionários.csv") has the field "email" and "rh_status";
So, i can't combine the results:
index="teste-ad" OR (index="tst-compliance" AND source="Composição das tribos - Relação funcionários.csv")
| eval em=coalesce(EmailAddress,email)
| table em Enabled rh_status
The results are combined, but they need to be merged. Use the stats command for that.
index="teste-ad" OR (index="tst-compliance" AND source="Composição das tribos - Relação funcionários.csv")
| eval em=coalesce(EmailAddress,email)
| stats values(*) as * by em
| table em Enabled rh_status
Thank you so much.
The results are combined, but they need to be merged. Use the stats command for that.
index="teste-ad" OR (index="tst-compliance" AND source="Composição das tribos - Relação funcionários.csv")
| eval em=coalesce(EmailAddress,email)
| stats values(*) as * by em
| table em Enabled rh_status