https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564858#M196766 <P>Aah, the trick is to combine fields....<BR />Of course. Very smart.<BR /><BR />Thank you very much.<BR /><BR /><SPAN>Regards,</SPAN></P><P>Harry</P> Thu, 26 Aug 2021 10:34:38 GMT hvdtol 2021-08-26T10:34:38Z https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564853#M196764 <P>Hi,<BR /><BR />I am trying to combine data from 2 indexen, but i find it hard to do.<BR />I tried several stats values command, but that&nbsp; did not gave me the solution<BR />This is my source:</P><P>collection&nbsp; &nbsp; &nbsp; &nbsp; hostname&nbsp; &nbsp; &nbsp; &nbsp; stage&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; stagedata<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A1234;DEF<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A3456;XYZ<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A7890;XYZ<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B1234;ABC<BR />COLLA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;h1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1<BR />COLLA&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1<BR />COLLB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st2<BR />COLLB&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st2<BR />COLLC&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;h5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1<BR />COLLD&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; h6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st3</P><P><BR />An this is what i am trying to accomplice:</P><P>collection hostname&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; stage&nbsp; &nbsp; &nbsp;stagedata<BR />COLLA&nbsp; &nbsp; &nbsp; &nbsp;h1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A1234;DEF<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A3456;XYZ<BR />COLLA&nbsp; &nbsp; &nbsp; &nbsp;h2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A1234;DEF<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A3456;XYZ<BR />COLLB&nbsp; &nbsp; &nbsp; h3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A7890;XYZ<BR />COLLB&nbsp; &nbsp; &nbsp;h4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; st2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A7890;XYZ<BR />COLLC&nbsp; &nbsp; h5&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A1234;DEF<BR />&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;A3456;XYZ<BR />COLLD&nbsp; &nbsp; &nbsp;h6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;st3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; B1234;ABC</P><P>Any help would be appreciated.</P><P>Regards,</P><P>Harry</P> Thu, 26 Aug 2021 10:01:00 GMT https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564853#M196764 hvdtol 2021-08-26T10:01:00Z https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564856#M196765 <LI-CODE lang="markup">| makeresults | eval _raw="collection,hostname,stage,stagedata ,,st1,A1234;DEF ,,st1,A3456;XYZ ,,st2,A7890;XYZ ,,st3,B1234;ABC COLLA,h1,st1 COLLA,h2,st1 COLLB,h3,st2 COLLB,h4,st2 COLLC,h5,st1 COLLD,h6,st3" | multikv forceheader=1 | table collection hostname stage stagedata | eval collectionhost=collection."!".hostname | fields - collection hostname | stats values(*) as * by stage | stats values(*) as * by collectionhost stage | eval collection=mvindex(split(collectionhost,"!"),0) | eval hostname=mvindex(split(collectionhost,"!"),1) | table collection hostname stage stagedata</LI-CODE> Thu, 26 Aug 2021 10:17:42 GMT https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564856#M196765 ITWhisperer 2021-08-26T10:17:42Z https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564858#M196766 <P>Aah, the trick is to combine fields....<BR />Of course. Very smart.<BR /><BR />Thank you very much.<BR /><BR /><SPAN>Regards,</SPAN></P><P>Harry</P> Thu, 26 Aug 2021 10:34:38 GMT https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564858#M196766 hvdtol 2021-08-26T10:34:38Z https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564862#M196768 <P>Please can you mark the solution as the solution rather than your response to the solution?</P> Thu, 26 Aug 2021 11:11:05 GMT https://community.splunk.com/t5/Splunk-Search/Combine-data-from-2-indexes/m-p/564862#M196768 ITWhisperer 2021-08-26T11:11:05Z