Regex merge match to single name

[webshan]

HI I have 2 log files(access log file and custom log file) with data as given below.

LogFile1 (access log)
GET /login HTTP/1.1 302 - 1234 800

Where 1234 is USERID

LogFile2 (custom file)
DATA EVENT->1234:loginTime SOME EVENT DESC

I want to get a report like below:

USER ACCESS_COUNT CUSTOM_COUNT
1234 4 5
2345 6 7
4567 7 8

I tried

source=access.log OR source=customlog.log QueryForAccess OR QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)|(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)"
|stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER

But I got cant use same pattern. I changed rex fields to USER1 & USER2 and stats as USER1,USER2 but could not get any result.

How do I ensure that I get report of USER who is in either access log or in custom log & their counts??

Thanks

[martin_mueller · Accepted solution]

I assume you are trying to have one rex pull a field from two different sourcetypes?

Consider two rex calls, something like this:

... | rex "some pattern" | rex "some other pattern" | ...

If you use different field names in each rex you can then merge them into one field using a combination of eval and a test for null/invalid values. However, using the same field name in both rex's should work as well. Just make sure the first pattern does not match the second sourcetype and vice versa.

[webshan]

Thanks for inputs. I tried as below and it worked for me.

source=customlog.log QueryForCustom | rex "(?i).*?\->(?P<USER>\d+)(?=:)" |  stats count(eval(searchmatch(QueryForCustom))) as CUSTOM_COUNT  by USER
| JOIN type=inner USER [SEARCH source=access.log OR QueryForAccess | rex "(?i)^(?:[^\-]*\-){5}\s+(?P<USER>[^ ]+)" |stats count(eval(searchmatch(QueryForAccess))) as ACCESS_COUNT by USER ] | USER, CUSTOM_COUNT, ACCESS_COUNT