Hi, I have a union'ed search where I am wanting to link different events based on fields that have matching values.
My search looks like this:
| union
[search message=*
| spath Field1
| spath Field2]
[search city=*
| spath FieldA
| spath FieldB]
| table Field1 Field2 FieldA FieldB
My current output looks like this:
Field1 | Field2 | FieldA | FieldB |
John | Blue | ||
Blue | Ohio | ||
Yellow | Wyoming |
However I need a way to link Field1 to FieldB if Field2=FieldA, where the output would look something like this:
Field1 | Field2 | FieldA | FieldB |
John | Blue | Blue | Ohio |
Yellow | Wyoming |
If there is a way to do something like this, please let me know, even if I need to create new fields. The excess FieldA and FieldB are unimportant if there is not a matching Field2.
please help, please
message=* OR city=*
| eval Field2=coalesce(Field2, FieldA)
| stats values(*) as * by Field2
| where isnotnul(Field1)