Just a small query: Lets say I need to find all values in one field in the access_logs matching values in some other fields:
For example a search like this:
Sourcetype="My_Custom_sourcetype" departure_city = return_city ...and so on..
We want to find all errors where the departure city and return city are the same.
Above we want to look at all values where dep_city equal values in return_city field. In SQL we normally use aliases for such joins. I have tried using FIELDALIAS but it does not seem to work. Would appreciate any help. Thanks.
I had a similar requirement and following worked for me:
Change
Sourcetype="My_Custom_sourcetype" departure_city = return_city
to
Sourcetype="My_Custom_sourcetype" |where departure_city = return_city
I had a similar requirement and following worked for me:
Change
Sourcetype="My_Custom_sourcetype" departure_city = return_city
to
Sourcetype="My_Custom_sourcetype" |where departure_city = return_city
Thanks so much. You are awesome.
You should set what host/source/sourcetype you want to define your field alias
Then set something like this:
let say departure_city
is on host1 and return_city
is on host2
host=host1
departure_city = my_city_alias
create another one for return_city on host2
host=host2
return_city = my_city_alias
in your search:
host=host1 OR host=host2 my_city_alias="Some City"
This should return events with departure_city
and return_city
that are the same.
Hope this helps.
Thanks for the answer. This query is useful, if we are looking for pairs given a particular city, But in my case, I want to do it for all combinations.