topic Use stat with two different Index with different fields name to define in Getting Data In

Use stat with two different Index with different fields name to define

jaciro11 — Fri, 12 Jun 2020 15:44:29 GMT

Hello Splunk TEAM,

I have a problem with my search because I use to different index and the data which I want to compare when I want to define by a field is different for example.

I have two Index

in one I have ContactByName and in the other index I have PerformedByName.
I the two fields I have the same data but when I want to compare the data in that information I cant.
I try to rename ContactByName as PerformedByName to do my search again but is not a good idea.

I have this Right now:

(index="inlooxtt" StatusName!=Completed StatusName!=Cancelled PerformedByName!=Donado* CreatedDate>2020-05-30 ProjectName!="Capac* General" ProjectName!="Preventas*") OR (index="inlooxtasks" ProjectStatusName!=Completed ProjectStatusName!=Cancelled ContactDisplayName!=Donado* ContactDisplayName!="null" ProjectName!="Capac* General" ProjectName!="Preventas*")
| rename ContactDisplayName as PerformedByname
| eval Tiempo_Ejecutado=(DurationMinutes/60), Tiempo_Planeado=WorkAmount
| stats dedup_splitvals=true sum(Tiempo_Ejecutado) as Tiempo_Ejecutado, sum(Tiempo_Planeado) as Tiempo_Planeado by PerformedByname

But I have this:

The Tiempo_Ejecutado didnt appear 😞

Thanks all

Re: Use stat with two different Index with different fields name to define

richgalloway — Fri, 12 Jun 2020 15:55:26 GMT

Try using coalesce in place of rename.

(index="inlooxtt" StatusName!=Completed StatusName!=Cancelled PerformedByName!=Donado* CreatedDate>2020-05-30 ProjectName!="Capac* General" ProjectName!="Preventas*") OR (index="inlooxtasks" ProjectStatusName!=Completed ProjectStatusName!=Cancelled ContactDisplayName!=Donado* ContactDisplayName!="null" ProjectName!="Capac* General" ProjectName!="Preventas*") | eval PerformedBy = coalesce( ContactDisplayName, PerformedByname) | eval Tiempo_Ejecutado=(DurationMinutes/60), Tiempo_Planeado=WorkAmount | stats dedup_splitvals=true sum(Tiempo_Ejecutado) as Tiempo_Ejecutado, sum(Tiempo_Planeado) as Tiempo_Planeado by PerformedBy

Re: Use stat with two different Index with different fields name to define

jaciro11 — Fri, 12 Jun 2020 16:48:03 GMT

Hello @richgalloway

It Working!!! Thanks you !!!!!!!

😁