I have 2 searches from two individual log files with Txid in common (could be outerjoin):  The first search I get the Txid from source file A and get the duration of that transaction. The second search (I used Drilldown Editor to create a click event -->   Set TxnId=$click.value$) is to retrieve appname, columns from a SQL statement,  host and by the selected Txnid. I'd like to make these two outputs as one result.  How do I do it?  The exact syntaxes I used are as follows: index="IDX"   (host="PRhosts")  source="WS.webapi.log"   "Controller.Post" "- End" | rex field=_raw "s/^.* {/{/" mode=sed  | spath output=status path=stat  |rex field=_raw "\s+T+\s(?<txid>.*?)\s+Controller\\.Post\s\\-\s(?<duration>.*?)\s\\-\s+End" |sort - duration |table txid duration index="IDX"  (host="PRhosts") source="*WS.Business.Milestones.log" |rex field=_raw "s/^.* {/{/" mode=sed |spath output=nv path=flds{}.nv |spath output=status path=stat |spath output=tid path=tid |spath output=fn path=flds{}.fn | search tid=$Txnid$ | table fn nv host status tid WS.Webapi.log raw date looks like one line below (and you can guess there is a - Begin somewhere above but there is no duration recorded): 08/10/22 19:21:18.33 p06712 [00017] T M2kYTm7ywE6RFEnqc9m_1g Controller.Post - 00:00:00:270 - End WS.Business.Milestones.log  raw data look like the following: 08/10/22 19:26:03.44 p08604 [00106] T {"tid":"H2R2JPpkiECRHW5hEszG3Q","sid":"T1-COOLSECURITY:CSAPPAUTH-{E7690AF7-D1F0-4A84-A612-7E47C9F07679}","stat":"Success","sf":"EmployeeLogic","sm":"GetAsync","dt":"2022-08-10T23:26:03.4462133Z","flds":[{"fn":"username","nv":"HostedRedirGlobalEmployeeWS_PR"},{"fn":"dbQueries","nv":"SQL_QUERIES=SELECT emp.EMP_ID, emp.REPORTS_TO_SCID, emp.DEPT_CODE , emp.EMP_ID\n FROM coolemp.SHIPS_COOL2 emp\n WHERE ((UPPER(emp.SYSTEM_PERSON_TYPE) != UPPER('Pending Worker'))) AND ((UPPER(emp.USER_SID) = UPPER(:emp_userSid)))"}]}   So I'd like to know how to join the above 2 results into one so I can show the duration, with fn and nv values that has the SQL field "emp.Last_Updated_Date". ... View more

I have a search result like below: { [-]    dt: 2021-06-24T22:46:40.7013297Z    flds: [ [-]      { [-]        fn: username        nv: LearningRegApplication      }      { [-]        fn: dbQueries        nv: SQL_QUERIES=Select emp.fieldA, emp.fieldB, emp.fieldC, emp.fieldD from Template.table emp WHERE (UPPER(emp.fieldA) = UPPER(:emp.fieldA)) AND (UPPER(emp.fieldB) = UPPER(:emp_fieldB)) AND (UPPER(emp.fieldC) IN (UPPER('aaa'), UPPER('bbb'), UPPER('ccc'), UPPER('ddd')))      }    ]    sf: EmployeeLogic    sid: T1-SECURITY-{A-8FE-76E9-C3A2-ED890B}    sm: GetAsync    stat: Success    tid: yb6Any-PG00IG53 } I used   |SPATH OUTPUT=status PATH=stat | SPATH OUTPUT=nv PATH=flds{}.nv | SPATH OUTPUT=fn PATH=flds{}.fn | Table fn nv host status.  The results return 4 columns.  Each row has the array of the 2 sets of key-value pair in the fn/nv stacked together.   But host and status has only hostname and status values as follows: fn            nv              host             status (Row 1) username     LearningRegApplication                                                                                          MyHost  Success (Row 1) dbQueries     SQL_QUERIES=Select emp.fieldA, emp.fieldB, emp.fieldC, emp.fieldD from Template.table emp WHERE (UPPER(emp.fieldA) = UPPER(:emp.fieldA)) AND (UPPER(emp.fieldB) = UPPER(:emp_fieldB)) AND (UPPER(emp.fieldC) IN (UPPER('aaa'), UPPER('bbb'), UPPER('ccc'), UPPER('ddd')))   And I have uploaded a CSV file that contains all query fields name.  I want to see each field was queried by which application and insert them in that field row (not sure what is the best way to present this information).  So the output may look like something below: fieldA  LearningRegApplication fieldB  LearningRegApplication, AThirdApp fieldC  LearningRegApplication, ASecondApp fieldD  LearningRegApplication fieldE  ASecondApp, AThirdApp fieldF  AForthApp   :   :  What is the way to use the full CSV list of field names to insert the app to each SQL field name? ... View more