Associating fields across events

[999chris]

Hi All,

I was hoping someone could answer my query:

I have the following:

index=ateme status=* | eval progress=if(status=="complete",100,progress) | stats latest(status) as Status, latest(progress) as Progress by jobId

Which creates a table I need. However the "jobId" field needs to be cross referenced with another field in a different event entry which would give me a filename and I would like to replace the jobId column with the filename associated with that jobId.

Does that make sense?

[sundareshr]

If the event that has the Filename also has the jobid, you can try this. If it doesn't you have to provide some samples

index=ateme status=* | eventstats values(filename) as filename by jobId | eval progress=if(status=="complete",100,progress) | stats latest(status) as Status, latest(progress) as Progress by filename