My requirement is not to merge Version2 and Version1 and display multiple values in Version1.. Merge two services then display only rows that matches RecordID in Version2. Instead (1) It is displaying all values from Serv1 (2) Version1 is displaying merged values ... View more

yes other search is fine, except that it's getting throttled/timed out ... View more

Yes, double quotes worked and hence the above issue.. ... View more

This is acting like left join with difference.. so basically keeping all records of the version1 and inserting value of the version2 into the version1 (now I can see old value of version1+version2) , along with version2 value in it's column.  it looks like this Serv1 Name RecordID Version Name1 RecordID1 ^5 Name2 RecordID2 5.5 Name3 RecordID3 5.7   Serv2 Place RecordID Version Pl1 RecordID1 5.5 Pl2 RecordID2  5.5 Pl3 RecordID7 4.7   End Result Name RecordID Vesrion1 Version2 Name1 RecordID1 ^5 5.5 5.5 Name2 RecordID2 5.5 5.5 Name3 RecordID3 5.7   ... View more

Thanks for the reply first one worked.. Stats did not work.. I am not getting the  version2 values.. pls see my response to other reply below Docs says join  only works for 50000 records and after some time it terminates.. hence wants needs to make stats work   ... View more

that did not work .. can only see Name and RecordID fields... version is populated because it's able to see that name in the original serv1 .. version1 is null. To test the above I modified your reply to following index=test (service=serv1 OR service=serv2) | eval version2 = if(service=serv2, version, null()) | eval version1 = if(service=serv1, version, null()) | stats values(*) as * by RecordID | table Name RecordID version1 version2  and now both version1 and version2 is empty..   also tried this with same results as above  index=test (service=serv1 OR service=serv2) | eval version2 = case(service=serv2, version) | eval version1 = case(service=serv1, version) | stats values(*) as * by RecordID | table Name RecordID version1 version2   Just to highlight.. End result I want is only values from Serv1, where there is a matching RecordID in the Serv2.. The whole point of this exercise is I want to replace all values of version in the Serv1 with version values from Serv2 where there is a matching RecordID and discard the rest. Serv1 is major data source and Serv2 is minor. ... View more

I tried all help and  [used Join command and/or stats command] .. nothing worked for my case ... View more