I am trying to make 2 searches using different indexes and sources
The first search is looking for all entries with "message sent" and the "Message Id". The second search is looking for the "Message Id" and "message sent".
I am trying to find the number of messages that were sent but not received by comparing the message ID, and list the message IDs that were not sent
Example Attempt:
(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId")
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId")
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*"
| stats values(*) as * by messageId
Something like
(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId") )
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") )
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*"
| rex "\bmessage\s+<?type>(sent|received)\b" ``` no need to specify field if _raw ```
| stats dc(messageId) as msgCount by type
| eval msgCount = if(type == "received", -msgCount, msgCount)
| stats sum(msgCount) as sent_not_received
You missed a couple parenthesis.