You are correct for not wanting to use join, for join is perhaps not what you need. But you need to give us precise prescription about the field or fields you want to join these three indices. Two ...
See more...
You are correct for not wanting to use join, for join is perhaps not what you need. But you need to give us precise prescription about the field or fields you want to join these three indices. Two of them have an identical field name "user". Do they have the same values? (Window and Unix usually do not.) Then, a different pair of indices have an identical field name "issuer". Then, there is yet another field name in cyber bearing semantic semblance of a user, namely "requestor". Is this the field you want to "join" with the "user" field in the other two indices? If you want to join requestor in cyber with user in the other two indices, the following should be your first draf: index IN (cyber, AD, unix)
| rename requestor AS user
| stats values(_eventtime) as _event_time, values(issuer) as issuer values(purpose) as purpose
values(elevID) as evelID, values(action) as action
values(path) as path, values(cmd) as cmd by user Even so, there can be variations depending on other requirements. Unless you give a prescription, others cannot give you a good answer.