Hi,
i want to join all three fields with common id field. please help me with search query
| table id servicename errordetails
i have data like this
Ex:
In index = abc "error"
servicename id
abc 101
gfg 102
hhv 105
and In index = abc "errordetails"
id errordetails
103 error1
102 error5
104 errorabc
105 error4545
i want to join both by field "id". so i want data like this
102 gfg error5
105 hhy error4545
Please help me with this
try something like this to avoid using join, as there are limits.
(index = abc "errordetails") OR (index = abc "error")
|stats values(servicename) as servicename values(errordetails) as errordetails by id
|where isnotnull(servicename) AND isnotnull(errordetails)
the where statement should ensure you're only grabbing ids that include both errordetails and servicename, without it, it's like an outer join.
try something like this to avoid using join, as there are limits.
(index = abc "errordetails") OR (index = abc "error")
|stats values(servicename) as servicename values(errordetails) as errordetails by id
|where isnotnull(servicename) AND isnotnull(errordetails)
the where statement should ensure you're only grabbing ids that include both errordetails and servicename, without it, it's like an outer join.