Hello, lets say I have events from two sourcetypes:
- time, ip, hostname
- time, ip, username
Now I want to match username to hostname based on the time and ip field in the following manner: ip has to be the same, time has to be the closest time (before or after). Any easy out of the box way for doing that?