Hey everyone. We have a number of different sources. Each needs to be correlated with the others using either an ingress or egress ID. For example, in our first source, we have an egress ID since its where the process starts. The next server has an ingress ID and an egress ID, and so on until the final device.
All of our data sources are CSV files. First, what is the best way to correlate each of these sources?
Right now I'm looking at doing something like this:
search index=correlation sourcetype=source1
|eval ingress_id_for_source2=egress_call_id_from_source1
|join ingress_id_for_source2 [search index=correlation sourcetype=source2]
Something like this. I know this isn't optimum (and its probably not correct). Any suggestions? Please note this will happen multiple times. Stats won't work since we actually need the data from individual events, not aggregations of it. I want to chain all of the fields together to get a single record of the user's action across all of the systems.
