Hello, I'm trying to combine different events (with different fields) into one event based on a common field value.  Is there an easy way to do this?  For example: (index=data sourcetype=source1) OR (index=customer sourcetype=sourcetype2) Event from Source 1: customer#: 12345 billingpackage: fastspeed speed: 50m Event from Source 2: customer#: 12345 address: 1st street noth zip: 41783 Desired Event: customer#: 12345 billingpackage: fastspeed speed: 50m address: 1st street north zip: 41783 Thanks in advance for the help! ... View more

Hi All, I'm stumped on the following search. The scenario is I'm trying to track the amount of time a support ticket is assigned to a support team and specific status, for the lifecycle of the ticket. The following |streamstats works great, assuming the ticket doesn't get assigned to the same team and status twice. (getting assigned out and back in) It currently sums the time between. Again, I only want to sum the time in a team and status, not including the time between where it goes out. |dedup ticket_id,_time,ticket_arvig_status |eval temp2=id+","+ticket_status |search (ticket_team="TIER 2" AND ticket_status="tier 2 needed" |streamstats range(_time) AS StatusDuration by ticket_id global=f window=2 |stats sum(StatusDuration) AS TotalStatusDuration by ticket_id, ticket_status, ticket_team |stats avg(TotalStatusDuration) as averageage by ticket_id Any help would be appreciated! ... View more