Hi ,
I have two searches withing same index but different sources and sourcetypes
index=XXX source=XXX |XMLKV |search Category="CDMSP" RI="0" | table _time,Category,F,RI
which gives me time category function and request ID from my app log
and another search
index=XXX source="XXXX" sourcetype=XXXX |table _time,SNMP_Message
Which gives me time and SNMP messages
Now i want to correlate both these searches based on time and display a table so that i can know at a particular time what function,RI ,SNMP Message category are executed
so a complete table based on time
index=XXX source=XXX |XMLKV |search Category="CDMSP" RI="0" | [search index=XXX source="XXXX" sourcetype=XXXX |table _time,SNMP_Message] | table _time,Category,F,RI,SNMP_Message
or, please check this one -
index=XXX source=XXX OR (source="XXXX" sourcetype=XXXX)
|XMLKV |search Category="CDMSP" RI="0" |table _time,SNMP_Message,Category,F,RI,SNMP_Message