You are correct to not wanting to use join; in fact, try not use join even if they are in different indices. Thank you for illustrating data and desired output. Here is an idea sourcetype IN (CopL...
See more...
You are correct to not wanting to use join; in fact, try not use join even if they are in different indices. Thank you for illustrating data and desired output. Here is an idea sourcetype IN (CopLocation, TargetLocation)
| eval target_log = replace(_raw, "^[^<]+", "")
| spath input=target_log
| mvexpand FileTransfer.FileName
| eval FileName = coalesce(file_name, 'FileTransfer.FileName')
| chart values(_time) over FileName by sourcetype
| sort CopyLocation
| foreach *Location
[eval <<FIELD>> = strftime(<<FIELD>>, "%F %T")]
| fillnull TargetLocation value=Pending (Obviously I do not know your sourcetype names. So, adjust the above accordingly.) Here is an emulation to produce the sample data you illustrated | makeresults
| eval sourcetype = "CopyLocation", data = mvappend("2024-12-18 17:02:50, file_name=\"XYZ.csv\", file copy success",
"2024-12-18 17:02:58, file_name=\"ABC.zip\", file copy success",
"2024-12-18 17:03:38, file_name=\"123.docx\", file copy success",
"2024-12-18 18:06:19, file_name=\"143.docx\", file copy success")
| mvexpand data
| eval _time = strptime(replace(data, ",.+", ""), "%F %T")
| rename data AS _raw
| extract
| append
[makeresults
| eval sourcetype = "TargetLocation", _raw = "2024-12-18 17:30:10 <FileTransfer status=\"success\">
<FileName>XYZ.csv</FileName>
<FileName>ABC.zip</FileName>
<FileName>123.docx</FileName>
</FileTransfer>"
| eval _time = strptime(replace(_raw, "<.+", ""), "%F %T")]
``` the above emulates
sourcetype IN (CopLocation, TargetLocation)
``` Play with it and compare with real data.