I have this search to display sourcetypes by index.
| metasearch index=* sourcetype=* | stats values(sourcetype) as Sourcetypes by index
I have this search to show roles with indexes.
| rest /services/authorization/roles/ | rex field=id "https://127.0.0.1/services/authorization/roles/(?<Role>.*)" | table Role srchIndexesAllowed
How would I bring these two together so that the fields tabled are, index, Sourcetypes, and Roles?
| metasearch index=* sourcetype=* | stats values(sourcetype) as Sourcetypes by index | join index [| rest /services/authorization/roles/ | rex field=id "https://127.0.0.1/services/authorization/roles/(?<Role>.*)" | stats values(Role) by srchIndexesAllowed | rename srchIndexesAllowed as index]
| metasearch index=* sourcetype=* | stats values(sourcetype) as Sourcetypes by index | join index [| rest /services/authorization/roles/ | rex field=id "https://127.0.0.1/services/authorization/roles/(?<Role>.*)" | stats values(Role) by srchIndexesAllowed | rename srchIndexesAllowed as index]
And if needed just change
"https://127.0.0.1/services/authorization/roles/(?.*)"
to
"https://127.0.0.1:8089/services/authorization/roles/(?.*)"
r. Ismo