@richgalloway @ITWhisperer Here's the query:
(index=app* (app=Application source="abc" "eventName=what is your name" *className IN (first*,second*,third*,fouth*))
OR (app=Application1 sourcetype="music:pqr" source="music/pqr.log" "Random raw msf" "status=COMPLETED" *className IN (first*,second*,third*,fouth*))
OR (source="xyz/eventmanagement/eventmanagement.log" "messages from _raw" name=my_amazon_order OR name=my_shiprocket_order *className IN (first*,second*,third*,fouth*)))
OR (app=Application2 "raw message" source="aaa/orderdetailsave/orderdetailsave.log" **className IN (first*,second*,third*,fouth*))
earliest=$time.earliest$ latest=$time.latest$
| dedup field1
| eval component="FirstComp"
| join field1 type=outer
[ search index=index1 index1=main sourcetype="log4j:*" source="/var/log/*/random.log" host="host1*"
| dedup field1
| eval component= "secondcomp"
| eval field2=field1
]
| where isnull(field2)
| table field1
The problem statement is that Fist component has 1000 events whereas second component has 2000 events. While using inner join, both the components have 1000 common events. While using left join, the result should be 0 but I'm getting those 1000 events which are visible while using inner join. Also, query structure needs to be the same due to some prior JS changes.
... View more