Community, need some help to work with 2 different sourcetypes .
I'm trying to run a search where I need to match information from 2 sources in 1 table.
What I'm trying to do is:
index=u...
Hi,
I have a timechart which appends three types of data into one chart in this way:
eventtype=x sourcetype=x | where ... | table _time series value
| append [ search eventtype=y source...
...tats count as Open by time
| join type=outer time
[searchsource="Tickets" | eval SolvedAt=substr(SolvedAt,1, 7) | rename SolvedAt as time | stats count as Solved by time ]
| table time O...
I have a dashboard panel search that contains a subsearch that returns formatted results from three sourcetypes based on the username entered in the search field:
blocked OR deny [searchsource...
...lready tried with rename and it's working fine, but the problem is in feature these kind of sourcetypes (new logs files) will come, then rename applies for all the _json sourcetypes. So, how can we f...
...he two searches I would like to join are: Search 1: index="_internal" source="*metrics.log" per_index_thruput series=autoshell host=lelsplunkix* | eval GB=kb/(1024*1024) | timechart span=12h sum(G...
...| end time | count(sourcetype C)
To join start and endtime, I already have the following
index=* sourcetype=A | `Renaming` | join type=outer OrderId
[ search index=* sourcetype=B
| `Renam...