Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

black-out/ simple way to combine events from two sourcetypes on same Id

$
0
0
I must have a blackout because the case does not seem to difficult but i cant get it working. I have two sourcetypes, when an event in one sourcetype gets an error it will appear in the other sourcetype with some kind of a description. The Id in both the sourcetypes will be unique. How can I get a result from both sourcetypes when the error occures?

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>