How to Match event between two Index and get desired value

[ashiknew007]

Hi,

I am trying to match events between two index: Index A & Index B.
Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.

Both the data is different sources and different values, date-time.

My expectation is to match the user's cell no between two index based on below criteria:
1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_

index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| fields _time,CellNo,Agent,TIME-B]
| fillnull value="Not found"
| table _time(A),CellNo,TIME-B,Agent

2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A

Can anyone please help on this to share the commands.

[ashiknew007]

Hi gcusello,
many thanks for your feedback. here is feedback for your query:
1) Yes, correct. It is "CellNo"
2) Actually I want to mean here the time of Index-A with this "_time(A)"
3) with the word TIME-A & TIME-B, actually I mean here the value from Index-A and Index-B respectively.
I tried with "join type=inner" which shows me the value from all time and not only the 10m before data.
I will try ur command and get back to you.

[gcusello]

Hi ashiknew007,
Only few adding information:

• "CellNO" is a writing error, the correct one is CellNo, correct? Fieldnames are case sensitive!
• What's "_time(A)", there isn't any field with this name?
• if you use type=outher in Join, the most values haven't TIME-B field, is it correct?

Anyway, try something like this:

index=A | join CellNo type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| rename Agent AS AgentB
| fields _time,CellNo,AgentB,TIME-B]
| eval Agent=coalesce(AgentB,Agent)
| fillnull value="Not found" 
| table _time, CellNo, TIME-B, Agent

Bye.
Giuseppe