How can do mapping between two different source type say for exp. mapping between skelta log and iis log
In order to correlate events between two different sourcetypes, you need to identify the common fields.
Here is an example:
The events of sourcetype myMiddleware have two fields (in addition to a timestamp, host, source and sourcetype)
username
userip
The events of sourcetype myDBMS have three fields (in addition to a timestamp, host, source and sourcetype)
transId
userId
statusCode
Let's say that you want to report the number of transactions (based on transId) for each ip address. In this example, the username and userId fields are really the same thing, they are just named differently in the different sourcetypes. The following search will address these problems:
sourcetype=myMiddleware OR sourcetype=myDBMS |
rename userId as username |
transaction username transId |
stats distinct_count(transId) As TransactionCount by userip
I suggest that you play around with this and look at the Search Reference manual for more options and examples of these commands.
Exactly correlation between two sourcetype
Yes, what do you mean by "mapping"? Are you trying to correlate events between these two sourcetypes?
More details, please.