topic How do I display fields in two separate indexes in Splunk Search

How do I display fields in two separate indexes

epeeran — Mon, 20 Nov 2017 18:21:26 GMT

I have two separate indexes for example index A and index B. I need to display one field from index A and one field from index B in columns for each field next to each other. These two fields are NOT related but entirely different

Please kindly help?

Re: How do I display fields in two separate indexes

MuS — Mon, 20 Nov 2017 18:52:49 GMT

Hi epeeran,

basically you can do something like this:

index=a OR index=b
| eval id=coalesce(fieldA, fieldB)
| stats values(*) AS * by id

This will take either values from fieldA or fliedB as id and the stats will group everything by id.
You can also read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html to learn more about this topic.

Hope this helps ...

cheers, MuS

Re: How do I display fields in two separate indexes

elliotproebstel — Mon, 20 Nov 2017 21:08:23 GMT

Do you need to correlate the values of fieldA with the values of fieldB somehow? Or just list them in two columns, side by side?
If the latter, then this should work:

index=A OR index=B fieldA=* OR fieldB=* | stats values(fieldA) AS fieldA values(fieldB) AS fieldB

The stats values() will dedup the contents of the respective field. If you don't want to dedup and would prefer to list all values, including duplicates, then try this:

index=A OR index=B fieldA=* OR fieldB=* | stats list(fieldA) AS fieldA list(fieldB) AS fieldB

If you need to actually correlate the values of fieldA with the values of fieldB, then you'll need to identify something they have in common that links events from index A with events from index B. For example, maybe they both have a matching field called UUID. In that case, something like this should work:

index=A OR index=B fieldA=* OR fieldB=* UUID=*| stats values(fieldA) AS fieldA values(fieldB) AS fieldB BY UUID