All Apps and Add-ons

Use two indexes in one search

numeroinconnu12
Path Finder

Good morning everyone,

This is my first search:

index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

and my second research:

index="app_gue"
|eval collecte=if(tag = success, "No", "Yes") | table index collecte

I would like to combine the two researches into one, is that possible?

thanks,

0 Karma
1 Solution

numeroinconnu12
Path Finder

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"

View solution in original post

0 Karma

numeroinconnu12
Path Finder

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"
0 Karma

numeroinconnu12
Path Finder

Hello,

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

0 Karma

vnravikumar
Champion

Hi

Try this

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue") 
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")
| table toto_VPN_Role index collecte
0 Karma

numeroinconnu12
Path Finder

Hello @vnravikumar

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

0 Karma

vnravikumar
Champion

its toto_vpn or test_vpn?

0 Karma

numeroinconnu12
Path Finder

sorry, it's test_vpn.

0 Karma

vnravikumar
Champion

Please check that index is having data for the selected time range.

0 Karma

numeroinconnu12
Path Finder

For the same time range, this search works:
index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

0 Karma

vnravikumar
Champion

check this |collecte eval=if(action = success, "No", "Yes") or | eval collecte =if(action = success, "No", "Yes")

0 Karma

numeroinconnu12
Path Finder

it's :

| eval collecte =if(action = success, "No", "Yes") 
0 Karma

vnravikumar
Champion

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue")
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")

0 Karma

numeroinconnu12
Path Finder

it's the same, not event of : (index=test_vpn toto_VPN_Role="AU_GUE_WEB")

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...