My problem is I cannot get them tabled together in the same results view. If I try and add P1Sender to
This statement confirms @PickleRick and @ITWhisperer 's diagnosis: that field P1Sender only exists in one group of events, let's call them "event type 1", whereas fields Item.RecipientsCount, Item.Recipients{}.Name, Item.Subject are only present in a totally different group of events, let's call them "event type 2". (Most likely they are from two different sourcetypes in index office365.) The two groups have no overlap. The implied message they are trying to tell you when they ask you what your data look like is this: Unless you can demonstrate that the two groups have something in common, the result you desire, namely "quick view into emails a user has recently received," is an impossibility.
To make this obvious, let me give you two groups of mock events
| P1Sender |
| joe@example1.com |
| jab@example2.com |
| joey@example3.com |
and
| Item.RecipientsCount | Item.Recipients{}.Name | Item.Subject |
| 2 | bob@myco.com bobby@myco.com | You owe me $1,000,000. Where is my money? |
| 1 | rob@myco.com | I paid $1,000,000. Where is my shipment? |
Can you tell me who receive E-mail from whom?
Volunteers in this forum all understand privacy concerns. We ask what your data look like because we want to help you identify the link between these two groups. You have two paths forward:
- Find out which datum/data are in common among the two, and craft a logic to link the two to form a "quick view into emails a user has recently received," or
- Share format of raw events from the two groups which you believe can help forming a "quick view into emails a user has recently received." You can use mock events but the format must be the same as your raw events and any redaction must retain enough distinct features to establish possible logical connections between two groups.
As you have not realized that the two groups of events have no overlap, let me help you with the second path.
Run these two searches separately.
index=office365 P1Sender=* ``` event type 1 ```
and
index=office365 Item.Recipients{}.Name=*, Item.Subject=* ``` event type 2 ```
Inspect events from each type, find events that can form a "quick view into emails a user has recently received." Then, anonymize those events to share here.
This is some homework you should have done before posting question into a data analytics forum. These are four golden rules; nay, call them the four commandments:
- Illustrate data input (in raw text, anonymize as needed), whether they are raw events or output from a search (SPL that volunteers here do not have to look at).
- Illustrate the desired output from illustrated data.
- Explain the logic between illustrated data and desired output without SPL.
- If you also illustrate attempted SPL, illustrate actual output and compare with desired output, explain why they look different to you if that is not painfully obvious.
