https://community.splunk.com/t5/Splunk-Enterprise/how-to-get-one-of-the-fields-by-searching-multiple-indexes/m-p/506110#M2199 <P>example i have multiple indexes like index1, index2, index3. amoung these a field named "Category" presents in index2.<BR /><BR />I want to write a query without using OR (index=index1 OR index=index2 OR index=index3), which searches my field&nbsp;"Category" first in index1 then comes to index2 finds the result and doesnt go to index3.<BR />reason being i dont want to load a index after i found my result in previous index. if i go with OR it loads all three indexes in the result.<BR /><BR />Someone please help me here..</P> Thu, 25 Jun 2020 07:58:20 GMT sivaranjiniG 2020-06-25T07:58:20Z https://community.splunk.com/t5/Splunk-Enterprise/how-to-get-one-of-the-fields-by-searching-multiple-indexes/m-p/506110#M2199 <P>example i have multiple indexes like index1, index2, index3. amoung these a field named "Category" presents in index2.<BR /><BR />I want to write a query without using OR (index=index1 OR index=index2 OR index=index3), which searches my field&nbsp;"Category" first in index1 then comes to index2 finds the result and doesnt go to index3.<BR />reason being i dont want to load a index after i found my result in previous index. if i go with OR it loads all three indexes in the result.<BR /><BR />Someone please help me here..</P> Thu, 25 Jun 2020 07:58:20 GMT https://community.splunk.com/t5/Splunk-Enterprise/how-to-get-one-of-the-fields-by-searching-multiple-indexes/m-p/506110#M2199 sivaranjiniG 2020-06-25T07:58:20Z