Show multi values

[kig121]

Hi, i am a beginner.

I have 2 sourcetype (table). One of conatins requirement_id other ones conatins Testcase_id and requirement_id.

Must have: Join Testcase_id sourcetype to Requirement_id

Note: Sorting (ordering of Testcase_id sourcetype is not a solution, because requirment_id souercetype  table contains many other important attribute which is missing Testcase_id sourcetype.

Requirement id

1

2

3

4

5

Testcase_id	Requirement_id
14	1
14	2
14	3
87	1
87	2
87	3
76	4
67	4
45	5

My Expectation:

Requirement_id	Testcase_id
1	14
1	87
2	14
2	87
3	14
3	87
4	76
4	67
5	45

[isoutamo]

Hi

you could try the next

Index IN (<IDX 1>, … <IDX 2>) sourcetype IN (st1, st2)
| stats values(*) as * by Requirement_id, Testcase_id 
| sort Requirement_id

r. Ismo 

[ITWhisperer]

search test case
| join requirement_id [search requirements]
| sort requirement_id