I am looking to grab the data that fall under two completely different searches.
I have these two searches.
index="A"
| iplocation src
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, usr1
| where count > 25
AND
sourcetype="B"
| bucket _time span=1m
| stats count by _time, usr2
| where count > 25
I want to combine them. Here is what I have so far but it doesn't pull up the data.
index="A" OR sourcetype="B"
| eval id=case(index="A", "usr1", sourcetype="B", "usr2")
| iplocation src
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, id
| where count > 25
sourcetype="B" does not contain iplocation or country information. This, I believe, is the issue.
I have tried subsearches, join, append, etc...
Any advise is appreciated.
Give this a try
index="A" OR sourcetype="B" status=200
| eval id=case(index="A", "usr1", sourcetype="B", "usr2")
| eventstats values(src) as src1 by id | eval src=coalesce(src,src1)
| iplocation src
| search Country!="country1"
| bucket _time span=1m
| stats count by _time, id
| where count > 25
Give this a try
index="A" OR sourcetype="B" status=200
| eval id=case(index="A", "usr1", sourcetype="B", "usr2")
| eventstats values(src) as src1 by id | eval src=coalesce(src,src1)
| iplocation src
| search Country!="country1"
| bucket _time span=1m
| stats count by _time, id
| where count > 25
Awesome. It worked. Can you explain why?
The eventstats was the trick. After | eval id=case(
, you'll a common field between both index=A and sourcetype=B. Using this common field, the eventstats added the src to events in sourcetype=B where it was not earlier. After that since src was available in all events now, iplocation and Country based filter worked.
Ahhh. Makes sense now. Thank you.