Good day, Is there a way to join all my rows into one? My simple query index=collect_identities sourcetype=ldap:query user
| dedup email
| table email extensionAttribute10 e...
In my logs I am getting 4 events for 1 id. 1)Updating DB record with displayId=ABC0000000; type=TRANSFER 2)Updating DB record with displayId=ABC0000000; type=MESSAGES 3)Updating DB re...
Hey guys, I'm having trouble joining two datasets with similar values I'm trying to join two datasets, both have a common "name" field, but the one on the left has the correct value and the one on t...
...eel like I've tried everything (join, append + eventstats, subsearching) and unfortunately all have a limit which prevent me from getting the full set mapped. Join limit: 50,000 Append limit: 1...
Hi I have a difficult one - I am unsure if it is possible. I have large JSON data - Distributed traces. I can extract the data I need by doing 2 separate SPL - but I need to join them now, I...
I am trying to join two searches together to table the combined results by host.
First search below is showing number of events in the last hour by host, index, and sourcetype:
| tstats count w...
this is the query, so i'm still a baby in this world (so I'm sorry if there is a dummy mistakes that might drive you crazy when you read this query). However, I'm trying to Join the Source Process I...
I have two searches and I only want to find rows which has common MessageID . Currently it is returning extra row because of second search . Query before Or is returning 100 records ...
...eneric representation of my current query but I get nothing back.
index=event ... | join left=event right=vpn where event.src_ip=vpn.client_ip max=1 usetime=true earlier=true [search index=v...
Hi,
Join is not returning the data with subsearch, I tried many options from other answers but nothing working out.
Target is to check how many departments are using latest version of s...