It's pretty straightforward to do that | makeresults format=csv data="VIN,MAKE,MODEL
1234ABCD,FORD,GT
ABCD1234,DODGE,VIPER
1A2B3C4D,CHEVROLET,CORVETTE
A1B2C3D4,AUDI,"
| eval sourcetype="autos"
| app...
See more...
It's pretty straightforward to do that | makeresults format=csv data="VIN,MAKE,MODEL
1234ABCD,FORD,GT
ABCD1234,DODGE,VIPER
1A2B3C4D,CHEVROLET,CORVETTE
A1B2C3D4,AUDI,"
| eval sourcetype="autos"
| append [
| makeresults format=csv data="SN,MANUFACTURER,PRODUCT
1234ABCD,FORD,GT
ABCD1234,DODGE,CARAVAN
1A2B3C4D,CHEVY,CORVETTE
A1B2C3D4, ,A8"
| eval sourcetype="cars"
]
``` Above is sample data setup, but imagine your data above has come from
index=your_index sourcetype=autos OR sourcetype=cars
```
``` Now use VIN as the common field - there are actually many ways to do
the same thing, but what you are doing here is to make the dc_XXX fields
ones to be counted for uniqueness.
```
| eval VIN=coalesce(VIN, SN), dc_makes=coalesce(MAKE, MANUFACTURER), dc_models=coalesce(MODEL, PRODUCT)
``` Here there stats values collects all the original data - you may want
to add a | fields statement here to limit to the fields you want
It also counts the unique values of the dc_* fields which is the make
and model from whichever sourcetype ```
| stats values(*) as * dc(dc_*) as dc_* by VIN
``` And now this will find your mismatch items ```
| where dc_makes>1 OR dc_models>1
| fields - sourcetype dc_* Hope this helps