Need help to comparing two pieces of information from two different hosts

[murilocepeda]

how can I compare information from two different hosts?

For exemple, On a host I have the name, number and phone calls. In another I have Name, number, phone calls and location.

Can I compare the two information based on logic? Example: if phone calls (host1) = 0 and phone calls (host2) = 0, status = ok

my logic

index=zzzz host=yyyy or host=xxxxx | name, phone_call, location

eval description=case(phone_call(host1) == 0 AND phone(call(host2) == 0, "ok") | table description

Thanks, sorry  for my bad english

[richgalloway · Accepted solution]

To be compared, data must be in the same event.  You can combine events from different hosts/sources with the stats command.

index=zzzz (host=yyyy OR host=xxxxx)
| eval phone_call1 = if(host="yyyy", phone_call), phone_call2 = if(host="xxxxx", phone_call)
| stats values(*) as * by number
| eval description=if(phone_call1==0 AND phone_call2==0, "OK", "Not OK")
| table description