https://community.splunk.com/t5/Splunk-Search/Choose-either-of-the-available-field-from-multiple-queries/m-p/499956#M139256 <P>I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.</P> Wed, 25 Mar 2020 07:15:50 GMT arnavzz 2020-03-25T07:15:50Z https://community.splunk.com/t5/Splunk-Search/Choose-either-of-the-available-field-from-multiple-queries/m-p/499956#M139256 <P>I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.</P> Wed, 25 Mar 2020 07:15:50 GMT https://community.splunk.com/t5/Splunk-Search/Choose-either-of-the-available-field-from-multiple-queries/m-p/499956#M139256 arnavzz 2020-03-25T07:15:50Z https://community.splunk.com/t5/Splunk-Search/Choose-either-of-the-available-field-from-multiple-queries/m-p/499957#M139257 <PRE><CODE>index=A OR index=B | eval common=coalesce(Ta,Tt) | stats p95(common) dc(index) as flag by common | where flag &gt; 1 </CODE></PRE> Sun, 05 Apr 2020 00:19:22 GMT https://community.splunk.com/t5/Splunk-Search/Choose-either-of-the-available-field-from-multiple-queries/m-p/499957#M139257 to4kawa 2020-04-05T00:19:22Z