Hello there.
I have reading some answers similar to mine, but none of them fit with what I have in mind.
I have two searches, both of them in different indexes.
Search A:
index=indexA field1="value1" (field2="value2" OR field3="value3)
| eval _time=strptime(fieldTime,"%Y-%m-%d %H:%M:%S")
| eval ID=field4.field5.field6
| stats latest(field7) as F7, latest(field8) as F8, latest(field9) as EstimatedTime by ID
Search B:
index=indexB AND NOT ("some_value1" OR "some_value2") earliest=1 latest=now
| dedup _time
| append [
search index=indexB "some_value1" OR "some_value2" earliest=1 latest=now
| dedup _time
| transaction maxpause=1h maxevents=2
| where eventcount=2
| search F8="*" field10="*"
| lookup some_lookup.csv field11 as F8 field12 as F12 OUTPUT field13 as F13
| search F13="*"
]
| lookup some_lookup.csv field11 as F8 field12 as F12 OUTPUT field13 as F13
| streamstats last(_time) as InitialTime first(_time) as FinalTime window=2
I want to check if the EstimatedTime field from the search 1 is in the range of the time fields InitialTime and FinalTime from the second search to asign the correct data. How could I get this?
Regards.
I found a solution. I use an append to unify the two SPL, sort by _time and use transaction with startswith=eval(match()).
That do the trick.
Regards.
I found a solution. I use an append to unify the two SPL, sort by _time and use transaction with startswith=eval(match()).
That do the trick.
Regards.
@slorente - EDIT -
I didn't realize this but if you have a code block inside - or even near - a list, it seems to break the code block.
I changed your post around just a bit to fix that, substituting bold for those list items and all seems well enough now.
-Rich