Hi,
I have 2 data logs "datasource1" and "datasource2", under same sourcetype name="DATALOGS", for e.g.
datasource1
variable1=111
variable2= 222
variable3= 333
datasource2
variable1=aaa
variable2= bbb
variable3= ccc
Now i want to get the value of variable1, if and only if variable2 value matches "123".
How to do this. Please Help...!!!
It would b great if you can provide sample output you're expecting...
How about:
variable2=123 | fields variable1
?
... | eval myval=if(match(variable2,"123"),variable1,"")