https://community.splunk.com/t5/Splunk-Search/Searching-and-matching-from-two-different-indexes-and-retrieving/m-p/499544#M195026 <P>I have two indexes that contain the same ip address but only one index contains hostnames for the ip addresses. How can I search and match the ip addresses from both indexes in the same query and table out each ip address with their corresponding hostname?</P> Sun, 01 Dec 2019 16:30:22 GMT cald0002 2019-12-01T16:30:22Z https://community.splunk.com/t5/Splunk-Search/Searching-and-matching-from-two-different-indexes-and-retrieving/m-p/499544#M195026 <P>I have two indexes that contain the same ip address but only one index contains hostnames for the ip addresses. How can I search and match the ip addresses from both indexes in the same query and table out each ip address with their corresponding hostname?</P> Sun, 01 Dec 2019 16:30:22 GMT https://community.splunk.com/t5/Splunk-Search/Searching-and-matching-from-two-different-indexes-and-retrieving/m-p/499544#M195026 cald0002 2019-12-01T16:30:22Z https://community.splunk.com/t5/Splunk-Search/Searching-and-matching-from-two-different-indexes-and-retrieving/m-p/499545#M195027 <P>Hi cald0002,</P> <P>Give this a try:</P> <PRE><CODE>(SPL to get events from index 1) OR (SPL to get events from index 2) | stats values(hostname) AS hostname by ip </CODE></PRE> <P>You might need to adapt the query to match the <CODE>hostname</CODE> and <CODE>ip</CODE> fields according to your events.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Sun, 01 Dec 2019 20:37:49 GMT https://community.splunk.com/t5/Splunk-Search/Searching-and-matching-from-two-different-indexes-and-retrieving/m-p/499545#M195027 MuS 2019-12-01T20:37:49Z