Hi @hasham19833 ,
You might try something like this:
(index=DS sourcetype=SCHed source="/archived/ABC.SCH") OR (index=AS sourcetype=ASED "Finished" earliest=-19hr latest=-7hr )
| spath output=availId path=Schedule.Window.Avail{@availId}
| eval AllKeys = coalesce(eventKey, availId)
| stats values(eventKey) as eventKey values(availId) as availId by AllKeys
| eval CheckMatch = if(eventKey == availId, "Match", "No Match")
This works if availId is NOT a multi-value field. If it IS a multi-value field, you will need to do something like this:
(index=DS sourcetype=SCHed source="/archived/ABC.SCH") OR (index=AS sourcetype=ASED "Finished" earliest=-19hr latest=-7hr )
| spath output=availId path=Schedule.Window.Avail{@availId}
| eval availId = if(isnull(availId), "-", availId)
| mvexpand availId
| eval availId = case( availId!="-", availId )
| eval AllKeys = coalesce(eventKey, availId)
| stats values(eventKey) as eventKey values(availId) as availId by AllKeys
| eval CheckMatch = if(eventKey == availId, "Match", "No Match")
Here is what it might look like:
... View more