How to join fields that have different values

[gravi]

I need to join two searches that do not have a common fields.

First search has a field FileName=Test.json
Second search has field FileName=Test.json.pgp

How do I join the two searches?

Thanks

[gcusello]

HJi @gravi,
if there's a rule in the values of filename in the second search (e.g. take all but extension), you could use regex to extract them, something like this:

index=index_A
| join FileName [ search index=index_B | rex field=FileName "(?<FileName>.*)\.\w+$" ]
| ...

Ciao.
Giuseppe

[woodcock]

Like this:

(index="indexA" AND sourcetype="sourcetypeA" AND FileName=Test.json)
(index="indexB" AND sourcetype="sourcetypeB" AND FileName=Test.json.pgp)
| rex field=FileName mode=sed "s/\.pgp$//"
| stats values(*) AS * BY FileName

[edgarsilva01]

Hi Gravi

Once I had a similar scenario, the first thing that worked for me was evaluated that both fields had the same type of data is "Strings"
After validating that, perform the inner join command to make the cross and compare the data.

Regards

[yannK]

what about an OR condition ?

  FileName=Test.json OR FileName=Test.json.pgp

Or if you have 2 searches and try to JOIN them, normalize the fields name or content, then use a join

 search1withoutpgp | eval FileName=FileName.".pgp" | join FileName [ search search2withpgp  |  table myotherfield FileName]