I'm looking for a way to search for freetext after a join.
It is easy when the field is known. For instance, there is a join with left L and right R, and the value of variable $id$ can be in one corresponding fields (in this example, both fields have the same name):
| search L.id=$id$ OR R.id=$id$
But how to search for something like freetext when this text can be a substring in any field of one of the two parts? I don't want to write a check for every field, so I tried things with "_raw" or "L._raw": Nothing worked.
You can use OR condition in your search and use stats where the events match, instead of doing a join operation.
index=myindex
("Processing started") OR ("Processing finished with result")
|stats count by id
|where count>1
Thanks for the fast reply. The idea is to join a request with the result of this request. Something like:
index=... "Processing started"
| join type=left left=L right=R where L.id = R.id [search index=... "Processing finished with result"]
| table _time L.id L.dataSource L.message R.message R.orderNumber
| sort _time desc
Simplified data:
id=1234 dataSource=system1 message="Processing started of request from user abc"
id=1234 dataSource=system1 message="Processing finished with result: Success" orderNumber=56789
can you provide some sample data?