How to combine the events from 2 different indexes and display the results in a table, when there are no matching fields in the indexes. Please suggest.
As the guys already said, it all boils down to what you mean by "combine".
You might simply do a search across two indexes.
You can use append, appendcols or multisearch.
Depends on what you want to achieve.
Trying to retrieve the correlationId from two different indexes and then use a table to show them.
correlationId field is present in index called abc and properties.correlationID is present in index called cde
Example:
index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* | table correlationId,properties.correltionId
when tried using above we are getting values for correlationId only
Hi
you could try this
index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=*
| eval correlationId = coalesce(correlationId, properties.correlationId)
| stats values(*) as * by correlationId
Just replace "values(*) as *" by all "values(field1) as field1" as you need. You can also use join id needed. The correct way to do this is depending what is your real need.
r. Ismo
As the guys already said, it all boils down to what you mean by "combine".
You might simply do a search across two indexes.
You can use append, appendcols or multisearch.
Depends on what you want to achieve.
You can append the search from one index to the search from the other index. The column in the table which don't have values from one index won't have values or you could use appendcols where the results from the second search are put alongside the results from the first search without correlating the results. Having said that, you are likely to have at least one common field, the timestamp field _time so you could use that to correlate the events from the two indexes?
Hi @manjunath_n,
reading your question, the only answer should be: it isn't possible!
but, I'm sure that it's different!
if you could share more informations maybe we could halp you.
e.g. share some samples of both the indexes to join and understand the result you would have could be a good starting point.
Ciao.
Giuseppe