Hi there
Is there a way to merge the results of two different searches, where I'm grouping the events with the transaction search command and group them again based on a value of a field from both searches?
Thanks Simon
Update: As requested, here are examples of my search:
Search 1:
index=smtp1 | transaction tr_id maxspan=2m | search status="sent"
Search 2:
index=smtp2 | transaction tr_id maxspan=2m | rex "Ok: queued as (?<remote_tr_id>[a-zA-Z0-9]+)" | search status="sent"
Now I'd like to merge the results where the value of tr_id of search 1 matches value of the field remote_tr_id of my search 2.
If possible, it's preferable to rewrite the search into a single search (OR'ing the source data and possibly making a more complex transaction), but if not, you can use the append
search command.
Done, see my two searches and the explanation
If possible, it's preferable to rewrite the search into a single search (OR'ing the source data and possibly making a more complex transaction), but if not, you can use the append
search command.
The problem with the Append Join Command, is that your search needs to be based on "stats,timechart,chart" command to do so.....I have tried using Inner Join to group transaction from multiple indexes, but it doesn't seem to work.
Yes, this is possible. I would suggest that you provide an example of your two different searches. (Use the "edit" link, to update your question)