We have a scenario where we have three different events that should combine together based on Event ID.
Event 1 Fields:
Event 2 Fields:
Event 3 Fields:
What we are trying to do is, when I click on “Event 1 Unique_ID” to get all Vulnerabilities for Selected Host for “Event 2” enriched with selected data from “Event 3”.
All three events are in the same index but different sourcetype.
What is the best approach here? Subsearch seems slow If I go “Event 2” first and then filter to “Event 1”. I want another way around.