search use case help with common field

[venkasplunk]

hi all,

have some query on search use case.

1) My requirement is to extract a hpotter from a log - ex: log looks like "Apr 16 14:42:51 2019 hhhhhh aaa: 12345678:job:a_b_c:hpotter"
2) I also have a log in this format, both from same index. format is "Apr 17 12:45:16 2019 hhhhhh aaa: 1234:c_b:magician:e_t:1234:ip=:x.y.z.a:action:x_y_z:detail:uname:hpotter i:ABCD lol (X/Y), time:x hours, reason:testing".

I want to have output like this , name from first log which is same in second log, but also Author and Time from second log.

Name Author Time
hpotter magician Apr 17 12:45:16

[woodcock]

Are there any fields that contain any of those key values or do we need to create everything?

[richgalloway]

How are the name and author fields identified in each event? The location of the name field looks very different in the two sample events.

[efavreau]

Could you please clarify why #1 matters at all in this case? It appears the output you are looking for correlates to all the content in #2. Please confirm and then I can provide an answer.

[venkasplunk]

Thank you, it matters because that a_b_c is an illegal activity and want to capture those.

Yes, that's the challenge am facing. Can you pls help?

[efavreau]

@venkasplunk Please use comments instead of answers. You can also update your question to provide clarity. Does the order of events always occur that the user commits a_b_c and then shows up in the other log? If not, what is the order of events? What is the timespan between the two events? Your examples would indicate it could be almost a day between the two events. Is that the case?

[venkasplunk]

Thank you, order of event is 2) comes first and then 1) comes.

Yes, you are absolutely right, timespan could be between 1hour - 12hours.