topic Re: How do I return a field(s) from a specific index, where the query has multiple search indexes? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-do-I-return-a-field-s-from-a-specific-index-where-the-query/m-p/401179#M116169 <P>Try something like below</P> <PRE><CODE>index=security sourcetype=symantec OR (sourcetyoe=WinHostMon (Path="malwarebytes")) | fillnull value="" | eval Host_table Host_Name,host |dedup Host_Name,host |eval host1 = if(sourcetype=WinHostMon,host,"")| stats values(host1) as host by hostname </CODE></PRE> Wed, 09 Jan 2019 20:32:30 GMT Vijeta 2019-01-09T20:32:30Z How do I return a field(s) from a specific index, where the query has multiple search indexes? https://community.splunk.com/t5/Splunk-Search/How-do-I-return-a-field-s-from-a-specific-index-where-the-query/m-p/401178#M116168 <PRE><CODE>index=security sourcetype=*symantec* OR (sourcetyoe=WinHostMon (Path="*malwarebytes*")) | fillnull value="" | table Host_Name,host |dedup Host_Name,host |sort Host_Name </CODE></PRE> <P>I want a column showing the Host_Name from the symantec source type and a column showing the host field from the Malwarebytes (WinHostMon sourcetype).</P> <P>Currently, I'm getting the Host_Name field correctly, but the host field is coming from symantec sourcetype</P> <P>like below<BR /> Host_Name host<BR /> 1 WKST-1315 sep<BR /> 2 WKST-1316 sep<BR /> 3 WKST-1317 sep<BR /> 4 WKST-1227 sep<BR /> 5 WKST-1295 sep</P> Wed, 09 Jan 2019 16:40:15 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-return-a-field-s-from-a-specific-index-where-the-query/m-p/401178#M116168 mmercola 2019-01-09T16:40:15Z Re: How do I return a field(s) from a specific index, where the query has multiple search indexes? https://community.splunk.com/t5/Splunk-Search/How-do-I-return-a-field-s-from-a-specific-index-where-the-query/m-p/401179#M116169 <P>Try something like below</P> <PRE><CODE>index=security sourcetype=symantec OR (sourcetyoe=WinHostMon (Path="malwarebytes")) | fillnull value="" | eval Host_table Host_Name,host |dedup Host_Name,host |eval host1 = if(sourcetype=WinHostMon,host,"")| stats values(host1) as host by hostname </CODE></PRE> Wed, 09 Jan 2019 20:32:30 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-return-a-field-s-from-a-specific-index-where-the-query/m-p/401179#M116169 Vijeta 2019-01-09T20:32:30Z