Hello,
I have two searches that use transactions to get part of a table of results that I want.
Firstly,
index="ems" sourcetype="queueconfig" OR sourcetype="topicconfig" | multikv noheader=true | rename Column_1 as config | search NOT "*sample*" | transaction instance | fields instance, application, config | fields - _time
This brings me a table, eg
App1 Result1
Result2 exampletext
Result3
App2 Result4 A text
Result5 b
Result6 c
And a second, which produces similar for a different sourcetype
index="ems" sourcetype="factoryconfig" | search NOT "" | strcat factoryName " - " url " - " type factoryconfig | fields instance, application, factoryconfig | transaction instance
App1 Connection1 details
Connection2 details
Connection3 details
App2 Connection4 details
Connection5 details
Connection6 details
What i want to do, is join the two searches
index="ems" sourcetype="queueconfig" OR sourcetype="topicconfig" | multikv noheader=true | rename Column_1 as config | search NOT "sample" | transaction instance | fields instance, application, config | fields - _time | join max=0 instance [search index="ems" sourcetype="factoryconfig" | strcat factoryName " - " url " - " type factoryconfig | fields instance, application, factoryconfig | transaction instance]
To get a table such as
App1 Result1 Connection1 - url - type
Result2 exampletext Connection2 - url - type
Result3 Connection3 - url - type
App2 Result4 A text Connection4 - url - type
Result5 b Connection5 - url - type
Result6 c Connection6 - url - type
But, when I do a join, it messes up the formatting and i get this, ie it gets rid of my nice formatting. Does anyone know why?
App1 Result1 Result2 example text Result3 Connection1 - url - type Connection2 - url - type Connection3 - url - type
App2 Result4 A text Result5 b Result6 c Connection4 - url - type Connection5 - url - type Connection6 - url - type
... View more