https://community.splunk.com/t5/Splunk-Search/Subsearch-with-different-index/m-p/548916#M155728 <P>Hi,<BR />I am using 2 indexes (index1 and index2). I want to pull a field from index1 (URL and rename it to url_1), and the in a subsearch I want to pull more fields from index 2. At the end I want a table with the field from index1(url_1) and the fields from index2.&nbsp;</P> Thu, 22 Apr 2021 10:08:24 GMT Godspeed_74 2021-04-22T10:08:24Z https://community.splunk.com/t5/Splunk-Search/Subsearch-with-different-index/m-p/548916#M155728 <P>Hi,<BR />I am using 2 indexes (index1 and index2). I want to pull a field from index1 (URL and rename it to url_1), and the in a subsearch I want to pull more fields from index 2. At the end I want a table with the field from index1(url_1) and the fields from index2.&nbsp;</P> Thu, 22 Apr 2021 10:08:24 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-with-different-index/m-p/548916#M155728 Godspeed_74 2021-04-22T10:08:24Z https://community.splunk.com/t5/Splunk-Search/Subsearch-with-different-index/m-p/548918#M155729 <P class="lia-align-left">Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/233685">@Godspeed_74</a>&nbsp;</P><P class="lia-align-left">try this:</P><LI-CODE lang="markup">index=index1 OR index=index2 | eval url_1=if(index=index1,url, "") | table url_1 (and all the list from the index2)</LI-CODE> Thu, 22 Apr 2021 10:21:37 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-with-different-index/m-p/548918#M155729 aasabatini 2021-04-22T10:21:37Z