Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Combine data from two source types based on common values

$
0
0
Hi there, I have question regarding source types. I have 2 source types A and B. A has field called aaa and B has field call bbb. These 2 fields share same value ( example: aaa=123, bbb=123) but the field name is different. I want to combine the two source types based on the fields with the same value(the value will change dynamically so I can't hardcode it) and extract data from both source types. Is it possible and if how to approach this? I try something like this: index=??? host=??? (sourcetype=A OR sourcetype=B) | rename aaa as bbb | rex field=_raw "ClientId=(?\d+)" | stats values(cID) as ID by bbb | eval Duration = round(Duration,3) | table Duration ID

Viewing all articles
Browse latest Browse all 47296

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>