index=security sourcetype=*symantec* OR (sourcetyoe=WinHostMon (Path="*malwarebytes*")) | fillnull value="" | table Host_Name,host |dedup Host_Name,host |sort Host_Name
I want a column showing the Host_Name from the symantec source type and a column showing the host field from the Malwarebytes (WinHostMon sourcetype).
Currently, I'm getting the Host_Name field correctly, but the host field is coming from symantec sourcetype
like below
Host_Name host
1 WKST-1315 sep
2 WKST-1316 sep
3 WKST-1317 sep
4 WKST-1227 sep
5 WKST-1295 sep
Try something like below
index=security sourcetype=symantec OR (sourcetyoe=WinHostMon (Path="malwarebytes")) | fillnull value="" | eval Host_table Host_Name,host |dedup Host_Name,host |eval host1 = if(sourcetype=WinHostMon,host,"")| stats values(host1) as host by hostname
Try something like below
index=security sourcetype=symantec OR (sourcetyoe=WinHostMon (Path="malwarebytes")) | fillnull value="" | eval Host_table Host_Name,host |dedup Host_Name,host |eval host1 = if(sourcetype=WinHostMon,host,"")| stats values(host1) as host by hostname