I have same requestid such req123 that belong to different field name( f1 and f2 ) from two sourcetype A and B
I would like to make SPL search like below , how to make it ?
sourceype=A OR sourcetype B | "if f1(requestid)=f2(requestid) | table requestid user city work team .....
I don;t know what's eval command I need to here but I like to make SPL like before
sourcetype A , field_a(requestid) field_a2 , field_a3 ,field_a4
sourcetype B, field_b(requestid) field_b2, field_b3, filed_b4
(what kind of eval or join i need to use here ) ?????
where field_a(requestid)=field_b(requestid)
table field_a(requestid) field_b(requestid) field_a3 ,field_a4 ,filed_b4
Check out the coalesce function of eval
(sourcetype=A AND f1=) OR (sourcetype=B AMD f2=) | eval requestid=coalesce(f1,f2) | table requestid user city work team .....
Corrected text of search:
(sourcetype=A AND f1=*) OR (sourcetype=B AMD f2=*) | eval requestid=coalesce(f1,f2) | table requestid user city work team .....