i want to join all three fields with common id field. please help me with search query
| table id servicename errordetails
i have data like this
In index = abc "error"
and In index = abc "errordetails"
i want to join both by field "id". so i want data like this
102 gfg error5
105 hhy error4545
Please help me with this
try something like this to avoid using join, as there are limits.
(index = abc "errordetails") OR (index = abc "error")
|stats values(servicename) as servicename values(errordetails) as errordetails by id
|where isnotnull(servicename) AND isnotnull(errordetails)
the where statement should ensure you're only grabbing ids that include both errordetails and servicename, without it, it's like an outer join.
View solution in original post