Got 2 input datas, one pulled every two minutes and the other every 10 minutes.
I would like to have a table containing columns from the two datas (= 2 sourcetypes) in real-time
I used appendcols like this :
sourcetype="cswports" host=sanlacsw2|dedup swFCPortIndex sortby -_time|sort +swFCPortIndex | appendcols [sourcetype="cswports-sfp" host=sanlacsw2 |dedup swSFPId sortby -_time|sort +swFCPortIndex]|table _time swFCPortIndex swFCPortSpecifier swFCPortPhyState swSFPTemp swSFPVoltage swSFPCurrent
But the subsearch is not in real-time.
Do you see another way?
Thxs for your help,
Datas look like : (each line=One port)
Sourcetype=CSWPorts
Sourcetype=CSWPorts-SFP
Does something like this work for your usecase?
sourcetype="cswports" OR sourcetype="cswports-sfp" host=sanlacsw2 | stats first(_time) first(swFCPortSpecifier) first(swFCPortPhyState) first(swSFPTemp) first(swSFPVoltage) first(swSFPCurrent) by swFCPortIndex
I'm not sure if you want first()
or last()
in your search
Does something like this work for your usecase?
sourcetype="cswports" OR sourcetype="cswports-sfp" host=sanlacsw2 | stats first(_time) first(swFCPortSpecifier) first(swFCPortPhyState) first(swSFPTemp) first(swSFPVoltage) first(swSFPCurrent) by swFCPortIndex
I'm not sure if you want first()
or last()
in your search
was last() but thks !