https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367251#M108331 <P>Thanks this worked!</P> Wed, 27 Sep 2017 12:20:28 GMT ryanprayacn 2017-09-27T12:20:28Z https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367249#M108329 <P>I have two indexes that I can successfully join via stats. However, both indexes have a common field named "STATUS". I want to be able to separate the STATUS field into STATUS1 and STATUS2 before the join - so I can see both. I have left out STATUS below but showing successful join SPL below:</P> <P>index=customertest OR index=valuetest | stats values(Spend) as spend values(Order) as order by Customer | fillnull value=NULL | mvexpand spend | sort Customer</P> <P>Any recommendations?</P> Wed, 27 Sep 2017 02:25:46 GMT https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367249#M108329 ryanprayacn 2017-09-27T02:25:46Z https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367250#M108330 <P>Try this...</P> <PRE><CODE>index=customertest OR index=valuetest | eval Status1=case(index="customertest", Status) | eval Status2=case(index="valuetest", Status) | stats values(Spend) as spend values(Order) as order values(Status*) as Status* by Customer | fillnull value=NULL | mvexpand spend | sort Customer </CODE></PRE> Wed, 27 Sep 2017 03:43:28 GMT https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367250#M108330 DalJeanis 2017-09-27T03:43:28Z https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367251#M108331 <P>Thanks this worked!</P> Wed, 27 Sep 2017 12:20:28 GMT https://community.splunk.com/t5/Splunk-Search/Common-Field-in-Two-Different-Indexes/m-p/367251#M108331 ryanprayacn 2017-09-27T12:20:28Z