there are two sourcetypes A & B which I want to use a search. Both them have a field userid.
Let's say sourcetype A tells us userId=1 is from country=US. In sourcetype B the field country does not exist. Is there a possibility to do a lookup in search time, that the country is added for all events of userid=1 in sourcetype B as well?
It would be possible to run a search for sourcetype A and create a lookup.csv.
And use this csv in a next step:
sourcetype=A OR sourcetype=B | lookup lookup.csv userid OUTPUT country
But I think there is a better/easier way which I don't know 🙂
sourcetype=A OR sourcetype=B | eventstats first(country) as userCountry by userid | eval country=coalesce(country,userCountry) |...
sourcetype=A OR sourcetype=B | streamstats first(country) as country by userid | .....