I am trying to match events between two index: Index A & Index B.
Index A have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Index B have 3 column: date-time, User's Cell NO, user's account type and the agent name who modify that user's information.
Both the data is different sources and different values, date-time.
My expectation is to match the user's cell no between two index based on below criteria:
1)_ If any "cell no" exist in "Index A" will match with "Index B" only 10min before of the Index A time. I tried below command which is not as expected result:_
index=A | join CellNO type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now
| fields _time,CellNo,Agent,TIME-B]
| fillnull value="Not found"
| table _time(A),CellNo,TIME-B,Agent
2) If any CellNo exist in Index-A but not exist in Index-B (just 10min before of the Index-A time), then i want to see the "agent name" from Index-A
Can anyone please help on this to share the commands.
many thanks for your feedback. here is feedback for your query:
1) Yes, correct. It is "CellNo"
2) Actually I want to mean here the time of Index-A with this "_time(A)"
3) with the word TIME-A & TIME-B, actually I mean here the value from Index-A and Index-B respectively.
I tried with "join type=inner" which shows me the value from all time and not only the 10m before data.
I will try ur command and get back to you.
Only few adding information:
Anyway, try something like this:
index=A | join CellNo type=outer usetime=true earlier=true [search index=B earliest=-10m latest=now | rename Agent AS AgentB | fields _time,CellNo,AgentB,TIME-B] | eval Agent=coalesce(AgentB,Agent) | fillnull value="Not found" | table _time, CellNo, TIME-B, Agent