Hello everyone, I am having two events with different sourcetypes that have similar fields with similar values however not the same. I have found a way to combine the fields by using coalesce, however I would like to combine the values as well in order to get a clear result I am running this search : index="main" category="Foo" OR sourcetype="foo"
| iplocation ip_address
| eval severity_level = coalesce(severity, foo_severity)
| geostats count by severity_level and I am having the following results. | longitude | latitude | HIGH | High | MEDIUM | Medium | LOW | Low |
| 143.2104 | -33.494 | 39 | 4 | 40 | 30 | 15 | 5 | And I want to get something like: | longitude | latitude | HIGH | MEDIUM | LOW |
| 143.2104 | -33.494 | 43 | 70 | 20 | Could you please give a hint? Thank you very much in advance.
... View more