https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346331#M160688 <PRE><CODE>index=idx_test OR index=idx_test1 | eval comboID=coalesce(id, ID, id1, ID1) | stats values(comboID) </CODE></PRE> Wed, 14 Jun 2017 17:58:22 GMT woodcock 2017-06-14T17:58:22Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346328#M160685 <P>Dear All,<BR /> I have a column named called id in file1.csv and id1 in file2.csv . </P> <P>File1.csv: File2.csv<BR /> ID: ID1<BR /> 1 1<BR /> 2 2<BR /> 3</P> <P>I have loaded into splunk and assign indexes for two files . I have retrieve the extra value 3 from ID(file1.csv) . Can you please help us in writing the splunk search query. Thanks</P> Wed, 14 Jun 2017 17:33:32 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346328#M160685 splunklakshman 2017-06-14T17:33:32Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346329#M160686 <P>Like this:</P> <PRE><CODE>... | eval comboID=coalesce(id, ID, id1, ID1) | stats values(comboID) </CODE></PRE> Wed, 14 Jun 2017 17:47:37 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346329#M160686 woodcock 2017-06-14T17:47:37Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346330#M160687 <P>Thanks for your posting your query. I have the fields in two indexes 1) ID in (index=idx_test) and ID1 in (index=idx_test1). Can you please help me in writing complete query. Thanks</P> Tue, 29 Sep 2020 14:30:07 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346330#M160687 splunklakshman 2020-09-29T14:30:07Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346331#M160688 <PRE><CODE>index=idx_test OR index=idx_test1 | eval comboID=coalesce(id, ID, id1, ID1) | stats values(comboID) </CODE></PRE> Wed, 14 Jun 2017 17:58:22 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346331#M160688 woodcock 2017-06-14T17:58:22Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346332#M160689 <P>I have tried the above query, its displaying 0 records. Thanks</P> Wed, 14 Jun 2017 18:05:38 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346332#M160689 splunklakshman 2017-06-14T18:05:38Z https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346333#M160690 <P>Did you correct the index names to be the ones you assigned to your files?</P> Wed, 14 Jun 2017 18:30:06 GMT https://community.splunk.com/t5/Splunk-Search/compare-two-fields-and-populate-missing-values/m-p/346333#M160690 DalJeanis 2017-06-14T18:30:06Z