https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298015#M2632 <P>@deepak007, you should ideally create a <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addaliasestofields">Field Alias</A> so that the field name becomes the same in both indexes and can be used for correlation.</P> Mon, 19 Feb 2018 04:45:36 GMT niketn 2018-02-19T04:45:36Z https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298013#M2630 <P>I have 2 indexes which have common values in their fields<BR /> index1 has a field dest containing few values which are matching to index2 DESTIP<BR /> need to create a search query for getting the values only for the matching value of <BR /> index1 dest and index2 DESTIP</P> <P>I tried<BR /> index=index1 OR index=index2 |eval destination=coalesce(dest, DESTIP)| table destination, app<BR /> and its not working</P> Mon, 19 Feb 2018 01:06:30 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298013#M2630 deepak007 2018-02-19T01:06:30Z https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298014#M2631 <P>try this:</P> <PRE><CODE>index=index1 OR index=index2| eval destination=case(isnotnull(dest), dest, isnotnull(DESTIP), DESTIP, 1=1, "unknown")| stats values(*) AS * by destination </CODE></PRE> <P>OR</P> <PRE><CODE>index=index1 OR index=index2 |eval destination=coalesce(dest, DESTIP)| stats values(*) AS * by destination </CODE></PRE> Mon, 19 Feb 2018 03:27:40 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298014#M2631 493669 2018-02-19T03:27:40Z https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298015#M2632 <P>@deepak007, you should ideally create a <A href="https://docs.splunk.com/Documentation/Splunk/latest/Knowledge/Addaliasestofields">Field Alias</A> so that the field name becomes the same in both indexes and can be used for correlation.</P> Mon, 19 Feb 2018 04:45:36 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/comparing-two-fields-from-different-indexes/m-p/298015#M2632 niketn 2018-02-19T04:45:36Z