help to join information from 2 different sourcetype

[jip31]

hi

I need to do a count on the field "titi" which exist in 2 different sourcetype following 2 conditions :

the field "cit" is related to the sourcetype "citrix" and the field "domain" is related to the sourcetype "web"

And "host" exist in both sourcetype

so I am doing something like this but i have no results

index=tutu sourcetype=citrix OR sourcetype=web
| search (cit<="3") AND domain=west
| stats dc(titi) by host

Is it enough to add a "by host" clause for matching the events or do I have to use a join command?

thanks

[ITWhisperer]

| search (cit<="3") AND domain=west

will find events in the pipeline that match these conditions - given that cit comes from one source type and domain comes from the other, there will be no events that match these conditions at the same time - try changing AND to OR

[jip31]

my need is to count only the host that have a cit<3 and a domain=west

so if I replace AND by OR i think i am going to count a host that has a cit<3 or a host that has a domain=west, is it true?

If yes it's not my need, so do I have to use a join command to do that?

[ITWhisperer · Accepted solution]

As I said, you have a pipeline of events from both sourcetype, your AND condition at this point will not find events which match the criteria - try something like this

index=tutu sourcetype=citrix OR sourcetype=web
| where cit<=3 OR domain=west
| stats values(titi) as titi dc(cit) as cit dc(domain) as domain by host
| where cit>0 AND domain>0
| eval count=mvcount(titi)

[jip31]

ok thanks