Extract data from 2 different logs

[chimuru84]

Hello community!

I want to extract data from 2 different logs like bellow:

Log 1: 2024-04-28 06:38:51 INFO Start auth for accountId=1, ip=192.168.1.1

Log 2: 2024-04-28 06:38:27 INFO Collect response for accountId=1, was: response=FINISH

For example for accountId=1 I have 10 logs with "Start auth", I mean 10 attempts of start auth.

In second log, for the same accountId I have 1 or more logs with FINISH.

I want to make a table like

accountId                              Start auth                                      FINISH

1                                                 10                                                       1

Could you helm me with this? 

Thank you.

[chimuru84]

It works, thank you very much. One more thing, time filter isn't work, I mean if I set for 24H, search return logs for all time

[ITWhisperer]

This is a different question. Please start a new question with as much detail as possible.

[ITWhisperer · Accepted solution]

Have you already extracted accountId and response? If response does not have any value (null) does the event come from log1? If so, you could try something like this

| eval state=coalesce(response, "Start auth")
| chart count by accountId state