https://community.splunk.com/t5/Splunk-Search/Create-One-Field-Value-from-two-indexes/m-p/317907#M95111 <P>Try this: <CODE>index =A OR index =B NOT source = 433 | eval Email=coalesce(EmailA,EmailB) | stats count by Email</CODE><BR /> Field values are not case-sensitive in Splunk, but if you want them lower case, you can wrap the coalesce in a lower() function.</P> Tue, 05 Sep 2017 17:15:48 GMT s2_splunk 2017-09-05T17:15:48Z https://community.splunk.com/t5/Splunk-Search/Create-One-Field-Value-from-two-indexes/m-p/317906#M95110 <P>Hello,</P> <P>I have index=A with values from January-April with the field value called EmailA. I have another index with values from May-June with a field value called EmailB. I need to look at the most frequent Emails from January to June. This is the search I am using but it is not combining the emails correctly- the field Email is pulling only from Index=A since I renamed that one last. An email could be used in January and June and I need to have the total count across both indexes. </P> <P>index =A OR index =B NOT source = <EM>433</EM> | eval EmailA=lower(EmailA)| eval EmailB =lower(EmailB) | rename EmailB as Email | rename EmailA as Email | stats count by Email</P> <P>And I am running this search with the time picker set from January to June. Thank you for the help!</P> Tue, 05 Sep 2017 16:58:26 GMT https://community.splunk.com/t5/Splunk-Search/Create-One-Field-Value-from-two-indexes/m-p/317906#M95110 katzr 2017-09-05T16:58:26Z https://community.splunk.com/t5/Splunk-Search/Create-One-Field-Value-from-two-indexes/m-p/317907#M95111 <P>Try this: <CODE>index =A OR index =B NOT source = 433 | eval Email=coalesce(EmailA,EmailB) | stats count by Email</CODE><BR /> Field values are not case-sensitive in Splunk, but if you want them lower case, you can wrap the coalesce in a lower() function.</P> Tue, 05 Sep 2017 17:15:48 GMT https://community.splunk.com/t5/Splunk-Search/Create-One-Field-Value-from-two-indexes/m-p/317907#M95111 s2_splunk 2017-09-05T17:15:48Z