How to correlate fields from two different searches?

[SaamerS]

Thanks in advance.

I have events from two different sources:

The first source (let's call it Source A) has the following fields in its events:
1. Name of job
2. Parent job

Source B:
1. Name of Job (Same as source A, but could be parent or child)
2. runTime

The run-time of the parent jobs can be broken down by the run-times of its child, but the correlation between parent and child can only be found in the first source.

I am stumped by this because the information is from two different sources. Any help will be appreciated!

[somesoni2 · Accepted solution]

Assuming you want to chart runtime of one parent job at a time . Try something like this:

source="B" [search source="A" parentJob="ParentJobNameYouWantPieChartFor" | stats count by jobName | table jobName]
| stats sum(runTime) as runTime by jobName

Other assumptions:

• You can search source A using source="A" and source B using source="B"
• On source="A", field names are jobNameand parentJob
• On source="B", field names are jobNameand runTime

[SaamerS]

@richgalloway
I would like to create a pie chart of how the children run-times breakdown the parent's run-time

@xpac
One parent, multiple children relationship. Children can't have children jobs.

[xpac]

Is this a single level relation?
Like, do all jobs belong to some parent job, and that's it? Or do some jobs have child jobs, and those have child jobs, and so on?

[richgalloway]

What is your question? What is your desired output?