Correlating logs from two different sources

[sneha03]

Hi Team,

I have two log sources ,say x and y.

For x we need to extract a field x1 and then for each x1 we need to take last six digit and search the logs from source y and we need to extract a field y1.

After this,we need to plot x1 vs y1.. and we need to find out x1 for which y1 is present and x1 for which y1 is not present.

Logically we need to showcase end to end journey of a transaction,where we have two different sources on same server.

[ITWhisperer]

This is too abstract - you could search one source based on another like this

search y [search x | eval query=substr(x1,-6,6) | dedup query | fields query | format]

But I am not sure where you would go from here, assuming this even searches y the way you are expecting to