Hi
I have two field that extract send & rec like this:
| rex "S\[(?<SEND>\w+\.\w+)" | rex "R\[(?<REC>\w+\.\w+)"
now have 2 query like this:
|table SEND count
SERVER1.HUB 10
|table REC count
HUB.SERVER1 50
need to combine them and excpected result is a sankey diagram like this:
SERVER1(10)> HUB(50) >SERVER1
FYI: comon value between result string is HUB.
any idea?
Thanks,
