It seems you do actually have correlation, which is the 3rd and 4th path elements of the source, so you can merge the event data on variableA and variableB using eventstats like this ``` Having extr...
See more...
It seems you do actually have correlation, which is the 3rd and 4th path elements of the source, so you can merge the event data on variableA and variableB using eventstats like this ``` Having extracted variableC from _raw this just clears variableC
from all events that are not the primary match, i.e. file.txt ```
| eval variableC=if(match(source, "\/file2.txt$"), variableC, null())
``` Need to get rid of the second data set events ```
| eval keep=if(isnull(variableC), 1, 0)
``` Now collect all values (1) of variableC by the matching path elements ```
| eventstats values(variableC) as variableC by variableA, variableB
``` Now just hang on to first dataset ```
| where keep=1 Here's a simulated working example | makeresults count=10
``` Create two types of path d0 and d1 /d3 ```
| eval source="/dir1/dir2/d".(random() % 2)."/d3/file.txt"
``` So we get an incorrect variableC extraction we don't want ```
| eval _raw="main_event_has_raw_match/"
``` Now add in a match for the two types above ```
| append [
| makeresults count=2
| streamstats c
| eval source="/dir1/dir2/d".(if(c=1, "0", "1"))."/d3/file2.txt"
| eval _raw="bla".c."/"
| fields - c
]
| rex field=source "\/dir1\/dir2\/(?<variableA>.+?(?=\/))\/(?<variableB>.+?(?=\/))\/.*"
| rex field=_raw "(?<variableC>.+?(?=\/))*"
| eval variableC=if(match(source, "\/file2.txt$"), variableC, null())
| eval keep=if(isnull(variableC), 1, 0)
| eventstats values(variableC) as variableC by variableA, variableB
| where keep=1
| table variable*
| sort variableA