Use two indexes in one search

[numeroinconnu12]

Good morning everyone,

This is my first search:

index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

and my second research:

index="app_gue"
|eval collecte=if(tag = success, "No", "Yes") | table index collecte

I would like to combine the two researches into one, is that possible?

thanks,

[numeroinconnu12 · Accepted solution]

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"

[numeroinconnu12]

Hello,

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

[vnravikumar]

Hi

Try this

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue") 
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")
| table toto_VPN_Role index collecte

[numeroinconnu12]

Hello @vnravikumar

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

[vnravikumar]

its toto_vpn or test_vpn?

[numeroinconnu12]

sorry, it's test_vpn.

[vnravikumar]

Please check that index is having data for the selected time range.

[numeroinconnu12]

For the same time range, this search works:
index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

[vnravikumar]

check this |collecte eval=if(action = success, "No", "Yes") or | eval collecte =if(action = success, "No", "Yes")

[numeroinconnu12]

it's :

| eval collecte =if(action = success, "No", "Yes") 

[vnravikumar]

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue")
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")

[numeroinconnu12]

it's the same, not event of : (index=test_vpn toto_VPN_Role="AU_GUE_WEB")