An alternative to regex is to use coalesce. For example, | foreach RU3NDS_*
[eval RU3NDS = coalesce(RU3NDS, <<FIELD>>)] As @gcusello mentioned, if you intend to use join command, conside...
See more...
An alternative to regex is to use coalesce. For example, | foreach RU3NDS_*
[eval RU3NDS = coalesce(RU3NDS, <<FIELD>>)] As @gcusello mentioned, if you intend to use join command, consider stats or another method instead. For example, | foreach RU3NDS_*
[eval RU3NDS = coalesce(RU3NDS, <<FIELD>>)]
| fields - RU3NDS_*
| stats values(*) as * dc(*) as dc_* by RU3NDS Here is a complete emulation to illustrate how to correlate without using join command: | makeresults format=csv data="RU3NDS, left_data_var
foo1, leftbar1
foo2, leftbar1
foo1, leftbar2
foo3, leftbar3"
| append
[makeresults format=csv data="RU3NDS_abcd, right_data_var
foo1, rightbar1
foo2, rightbar3
foo1, rightbar2
foo3, rightbar1"]
| append
[makeresults format=csv data="RU3NDS_efgh, right_data_var
foo1, rightbar3
foo2, rightbar1
foo1, rightbar3
foo3, rightbar2"]
``` data emulation above ```
| foreach RU3NDS_*
[eval RU3NDS = coalesce(RU3NDS, <<FIELD>>)]
| fields - RU3NDS_*
| stats values(*) as * dc(*) as dc_* by RU3NDS RU3NDS dc_left_data_var dc_right_data_var left_data_var right_data_var foo1 2 3 leftbar1 leftbar2 rightbar1 rightbar2 rightbar3 foo2 1 2 leftbar1 rightbar1 rightbar3 foo3 1 2 leftbar3 rightbar1 rightbar2