So, I have two indexes and sourcetypes with the following fields:
index1 and sourcetype1:
aip = 34.465.45.234
AppVendor = vendor1, vendor2, vendor3 (These are all from different events)
AppNa...
See more...
So, I have two indexes and sourcetypes with the following fields:
index1 and sourcetype1:
aip = 34.465.45.234
AppVendor = vendor1, vendor2, vendor3 (These are all from different events)
AppName = app2, app3, app1 (All from different events corresponding to position of the vendors above)
AppVersion = 3.0343, 1.354, 2.5465 (Same convention)
index2 and sourcetype2:
jsonevent.external_ip = 34.465.45.234
jsonevent.hostname = Host1
jsonevent.Username = User1
I use the following search:
(index=index1 sourcetype=sourcetype1) OR (index=index2 sourcetype=sourcetype2)
| rename jsonevent.external_ip as exip
| rename aip as agentip
| eval external_ip = coalesce(agentip, exip)
| stats values(jsonevent.hostname) as Hostnames, values(jsonevent.Username) as Users, values(AppVendor) as Vendors, values(AppName) as Applications, values(AppVersion) as Version by external_ip
| search Hostnames=* Users=* Vendors=* Applications=* Version=*
I get the following:
external_ip Hostnames Usernames Vendors Applications Version
34.465.45.234 Host1 User1 Vendor1 app1 1.354 Vendor2 app2 2.5465 Vendor3 app3 3.0343
What I want is the following:
external_ip Hostnames Usernames Vendors Applications Version
34.465.45.234 Host1 User1 Vendor1 app2 3.0343 34.465.45.234 Host1 User1 Vendor2 app3 1.354 34.465.45.234 Host1 User1 Vendor3 app1 2.5465
Does anyone have any ideas how to achieve this?