Using json auto in a join
I have two queries that work fine independently that parse JSON within the logs, but I can't get the join operator to work (i.e. join two sub queries on fields within a JSON), does anyone have an example of this? The query below returns a "field name not found" error
*
| join
(_sourceHost=*qa*
|json auto keys "eventdata.id" as id
|where name = "adm-event") as allData,
(METRICS-LOGGER adm _sourceHost=*qa*
|json auto keys "eventdata.id" as id
|where name = "adm-event" | max(_messageTime) group by %eventData.id) as maxDt
on allData.id = maxDt.id and allData._messageTime = maxDt._messageTime
Please sign in to leave a comment.
Comments
0 comments