In order to correlate events between two different sourcetypes, you need to identify the common fields.
Here is an example:
The events of sourcetype myMiddleware have two fields (in addition to a timestamp, host, source and sourcetype)
username
userip
The events of sourcetype myDBMS have three fields (in addition to a timestamp, host, source and sourcetype)
transId
userId
statusCode
Let's say that you want to report the number of transactions (based on transId) for each ip address. In this example, the username and userId fields are really the same thing, they are just named differently in the different sourcetypes. The following search will address these problems:
sourcetype=myMiddleware OR sourcetype=myDBMS |
rename userId as username |
transaction username transId |
stats distinct_count(transId) As TransactionCount by userip
I suggest that you play around with this and look at the Search Reference manual for more options and examples of these commands.
