Hi
I have one index with two sourcetypes: S1 and S2. In sourcetype S1 I have fields A, B, C and in sourcetype S2 I have fields D, E, F.
The values in B field will sometimes be equal to values in E field, where if they are equal my final output should be in form of table with fields A,B,C,D,E,F.
Please help on the same.
Hi
thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.
If B & E are unique identifiers that are the same, you could do something like this:
index=A (sourcetype=S1 OR sourcetype=S2)
| eval G=coalesce(B,E)
| stats values(A) as A values(C) as C values(D) as D values(F) as F by G
Hi
thanks for this. I should display the result in a table something like a table with all the fields combined to gether something like table A B C D E F. how to do this.
That search should do it. You can rearrange the fields like this if you want:
| fields A G C D F
(don't forget we made G the value of B or E)