OK. Got it. A run-anywhere search including mockup data | makeresults format=csv data="index,index1Id,curEventId,prevEventId,eventId,eventOrigin index1,23,11,13,, index1,34,12,14,, index1,35,12,...
See more...
OK. Got it. A run-anywhere search including mockup data | makeresults format=csv data="index,index1Id,curEventId,prevEventId,eventId,eventOrigin index1,23,11,13,, index1,34,12,14,, index1,35,12,16,, index1,65,17,11,, index1,88,15,12,, index2,,,,11,1 index2,,,,12,2 index2,,,,13,3 index2,,,,14,4 index2,,,,15,5 index2,,,,16,6 index2,,,,17,7" ```This is just a mockup data preparation; now the fun begins``` ```We make two EventId fields from our original one (we can't use rename because we don't want to overwrite the values in the "joining" events with null values``` | eval curEventId=if(index="index1",curEventId,eventId) | eval prevEventId=if(index="index1",prevEventId,eventId) ```And now we "copy over" the values from "single side" results into the compound "both sides" result``` ```Be cautious about streamstats limitations``` | sort - index | fields - index | streamstats values(eventOrigin) AS curEventOrigin by curEventId | streamstats values(eventOrigin) AS prevEventOrigin by prevEventId ```We only need the combined results, not the partial ones``` | where isnotnull(index1Id) ```clear empty fields``` | fields - eventId eventOrigin