@egt,
Another way is to use stats
index="your index" (source="source1" OR source="source2") |fields id,function,serial_number, leasing_end, leasing_start
|stats values(*) as * by id
Now you should be able to do further processing/checks on the data.
e.g.
Events(dummy)
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
Final result
|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
|stats values(*) as * by id
... View more