Join data for events

Dear All,

I want to get query view for filename against the username . filename comes from event2 and username comes from event1 for both events pid common.

Event 1 fields => timestamp pid username
Event 2 fields => timestamp pid filename read/write

desired query view => event2_timestamp event2_pid event1_username(match pid) event2_read/write

You may be able to do that using an aggregate filter to combine the two lines.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.