topic Re: Use two indexes in one search in All Apps and Add-ons

Use two indexes in one search

numeroinconnu12 — Wed, 18 Dec 2019 10:30:12 GMT

Good morning everyone,

This is my first search:

index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

and my second research:

index="app_gue"
|eval collecte=if(tag = success, "No", "Yes") | table index collecte

I would like to combine the two researches into one, is that possible?

thanks,

Re: Use two indexes in one search

vnravikumar — Wed, 18 Dec 2019 10:55:01 GMT

Try this

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue") 
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")
| table toto_VPN_Role index collecte

Re: Use two indexes in one search

numeroinconnu12 — Wed, 30 Sep 2020 03:24:12 GMT

Hello,

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

Re: Use two indexes in one search

numeroinconnu12 — Wed, 30 Sep 2020 03:24:16 GMT

Hello @vnravikumar

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

Re: Use two indexes in one search

vnravikumar — Wed, 18 Dec 2019 11:38:04 GMT

its toto_vpn or test_vpn?

Re: Use two indexes in one search

numeroinconnu12 — Wed, 18 Dec 2019 13:03:09 GMT

sorry, it's test_vpn.

Re: Use two indexes in one search

vnravikumar — Wed, 18 Dec 2019 13:07:54 GMT

Please check that index is having data for the selected time range.

Re: Use two indexes in one search

numeroinconnu12 — Wed, 30 Sep 2020 03:24:24 GMT

For the same time range, this search works:
index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

Re: Use two indexes in one search

vnravikumar — Wed, 18 Dec 2019 13:20:02 GMT

check this |collecte eval=if(action = success, "No", "Yes") or | eval collecte =if(action = success, "No", "Yes")

Re: Use two indexes in one search

numeroinconnu12 — Wed, 18 Dec 2019 13:26:22 GMT

it's :

| eval collecte =if(action = success, "No", "Yes")

Re: Use two indexes in one search

vnravikumar — Wed, 30 Sep 2020 03:27:26 GMT

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue")
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")

Re: Use two indexes in one search

numeroinconnu12 — Wed, 18 Dec 2019 13:37:09 GMT

it's the same, not event of : (index=test_vpn toto_VPN_Role="AU_GUE_WEB")

Re: Use two indexes in one search

numeroinconnu12 — Thu, 19 Dec 2019 09:42:11 GMT

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"