Hi All, We have an index indexA, which gets data from multiple agencies agentA, agentB, agentC, and another index indexB, which has only agentB data. Our requirement is to correlate between indexA and indexB to restrict the users to have access only to agentB data from both the indexes indexA and indexB. I tried below options: a. search filter using lookup as below, index=indexA | search [ | inputlookup indexB_lookup.csv | fields indexB_agentB | rename indexB_agentB as indexA_agentB] b. coreleation search as below, (index=indexA sourcetype=indexA_sourcetype ) OR ( index=indexB sourcetype=indexB_sourcetype) | fields indexA_agentB indexB_agentB sourcetype | eval agentB = coalesce(indexA_agentB,indexB_agentB) | stats dc(sourcetype) as dc_sourcetype values(sourcetype) as sourcetype values(indexA_agentB_raw) values(indexB_agentB_raw) by agentB | where dc_sourcetype=2 But, both the method did not work as the search filter allows the only host, source, source type, event type, search fields. Kindly let me know for any better option to restrict the user access only to agentB data from both the indexes.
... View more