Hi there,
I have question regarding source types. I have 2 source types A and B. A has field called aaa and B has field call bbb. These 2 fields share same value ( example: aaa=123, bbb=123) but the field name is different. I want to combine the two source types based on the fields with the same value(the value will change dynamically so I can't hardcode it) and extract data from both source types. Is it possible and if how to approach this?
I try something like this:
index=??? host=??? (sourcetype=A OR sourcetype=B)
| rename aaa as bbb
| rex field=_raw "ClientId=(?\d+)"
| stats values(cID) as ID by bbb
| eval Duration = round(Duration,3)
| table Duration ID
↧