Hello, I'm doing a table with users and the users IP. And I need to add an extra column with extra data from another index. like a join without the join if possible. My table is this:
index=linux action=* sourcetype=sftp | stats last(_time) as start first(_time) as end values(user) as Usuario values(src) as IP values(character) as "edited characters" by session
| rename session as "session number"
| fieldformat "end"=strftime(end, "%d/%m/%Y %H:%M:%S") | fieldformat "start"=strftime(start, "%d/%m/%Y %H:%M:%S")
| sort - end
And I would need an extra column in my table. This extra column has to grab the value of src of every row, and perform another search, and put the results in the column. It has to be something like:
index=myotherindex src=The_src_from_the_row | stats values(account) by the_src_from_the_row
(I need this for every row in the table)
because in myotherindex I have the accounts corresponding to the src in the first table
so my final table will look something like:
session number - start - end - IP - user edited_characters accounts
being "accounts" the result of the second search, I mean, the accounts by the src in the table.
I don't know if im clear in my request, since english is not my native language, if there is anything you need me to clarify, feel free to ask please.
P.D im planning to do a dashboard from this table
