Hi All,
We have 2 different sourcetype master and child need to join/append the source type on identity column master.id and child.mastertable_id. Please let us how can we display the result in search query using table format.
sourcetype=master :
id(pk)|filename|status
123|test1.txt|S
124|test2.txt|F
125|test3.txt|S
126|test4.txt|F
sourcetype=child :
id|mastertable_id(FK)|msg
221|124|connectivity issue
223|126|user aborted
Final result should look like:
id|filename|status|childid|msg
123|test1.txt|S|NA|NA
124|test2.txt|F|221|connectivity issue
125|test3.txt|S|NA|NA
126|test4.txt|F|223|126|user aborted
Thanks
What with this?
(your search)|rename id as childid|rename mastertable_id(FK) as id|rename id(pk) as id|stats max(filename) as filename,max(status) as status,max(childid) as childid,max(msg) as msg by id