As @PickleRick notes, if time is critical for correlation, bin is risky. This is one of the use cases where transaction is appropriate. But you cannot use span alone. Using index alone with _time ...
See more...
As @PickleRick notes, if time is critical for correlation, bin is risky. This is one of the use cases where transaction is appropriate. But you cannot use span alone. Using index alone with _time is also unsafe. From the context implied in mock data, you want transaction by user. It is very important that you describe these critical logic clearly, explicitly, and without help from SPL. The only obstacle is the field names "username" and "Users_Name"; this is so easily overcome with coalesce. (It is never a good idea to illustrate mock data with inaccuracy. If the field name is Users_Name, you should consistently illustrate it as Users_Name and not usersname.) One element that distracted people is the servtime and logtime conversion in initial illustrated SPL. These fields adds no value to the use case. This is the code that should get you started index=printserver OR index=printlogs
| eval username = coalesce(username, Users_Name)
| fields - usersname
| transaction username maxspan=3s
| table _time prnt_name username location directory file Using your corrected mock data, the above gives _time prnt_name username location directory file 2024-11-04 12:20:56 Printer2 tim.allen FrontDesk c:/documents/files/ document2.xlsx 2024-11-04 11:05:32 Printer1 jon.doe Office c:/desktop/prints/ document1.doc Here is an emulation of your mock data. Play with it and compare with real data | makeresults format=csv data="_time, prnt_name, username, location, _raw
2024-11-04 11:05:32, Printer1, jon.doe, Office, server event 1
2024-11-04 12:20:56, Printer2, tim.allen, FrontDesk, server event 2"
| eval index = "prntserver"
| append
[makeresults format=csv data="_time, Users_Name, directory, file, _raw
2024-11-04 11:05:33, jon.doe, c:/desktop/prints/, document1.doc, log event 1
2024-11-04 12:20:58, tim.allen, c:/documents/files/, document2.xlsx, log event 2"
| eval index = "printlogs"]
| eval _time = strptime(_time, "%F %T")
| sort - _time
``` the above emulates
index=printserver OR index=printlogs
``` Hope this helps