My two xml log looks like this
<items><item><name>Registered Users</name><value>139</value></item><item><name>Registered Internet Users</name><value>0</value></item><item><name>Connected Users</name><percent>0</percent><value>60 / 500</value></item><item><name>Connected Internet Users</name><percent>0</percent><value>0 / 0</value></item></items></tec>
Search for this
sourcetype=log_system "[SYSTEM]" "Registered Users" | head 1 | table name, value
Search Result for this is
name value
Registered Users 61
Registered Internet Users 0
Connected Users 1/50
Connected Internet Users 0 / 0
AND another log
search for this log
sourcetype=log_system "[SYSTEM]" "Status" | head 1 | table name, value
Search Result for this is
name value
Status Running
System Name RH12
Release R12
System Date 04-Dec-2000
OS Release Linux
How Do I combine these two results and How do I want to convert these value to fields?
My result should be similar this
name value
Registered Users 61
Registered Internet Users 0
Connected Users 1/50
Connected Internet Users 0 / 0
Status Running
System Name RH12
Release R12
System Date 04-Dec-2000
OS Release Linux
How Do I convert these value to fields?
e.g.
Registered_Users Registered_Internet_Users OS_Release
61 0 Linux
Thanks
Have you tried an OR clause in your search, like so:
sourcetype=log_system "[SYSTEM]" ("Registered Users" OR "Status") | head 1 | table name, value
Yes, due to head only one result will display.
I want to head 1 from both search.