For example, if we have several events and there is a field named from, which is only existed in the first event. Is it possible to append this value to another event?
I'd like to save it as a temporary value and then use it later. I tried with eval temp=from, but I cannot use it(temp) in later events.
Thanks in advance!
if you're speaking of later use in the same search, you can use appenpipe command to add the result of a different search (in your case the same search but only the first value).
If instead later means in other searches, you can store the from value in a lookup or in a summary index (eventually with a schedule search) and recall it when you need.
Thanks for your reply. I'm in the first case you mentioned. But I do not know how to use appendpipe to achieve the goal.
Let's look at an example.
| eval raw="xxx123,document1,orderRequest;document1,orderRequest"
| makemv delim=";" raw
| mvexpand raw
| rex field=raw "(?<id>\w+),doc"
Currently, the id field in the second event is empty, and I'd like to fill it with xxx123, since it is also the document1 type.
Could you write a query to achieve this one?
please try this:
| makeresults | eval raw="xxx123,document1,orderRequest;document1,orderRequest" | makemv delim=";" raw | mvexpand raw | rex field=raw "(?<id>\w+),doc" | stats values(id) AS id values(raw) AS raw BY _time | mvexpand raw
I'm sorry. In the real case, the timestamp is not equal. So I cannot use BY _time... Any other ideas?
What I'm trying to figure out is how to use xxx123 as a temporary value, and then whenever there is another document1 that occurs in new events, I can assign the value to the new events.