All Apps and Add-ons

Use two indexes in one search

numeroinconnu12
Path Finder

Good morning everyone,

This is my first search:

index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

and my second research:

index="app_gue"
|eval collecte=if(tag = success, "No", "Yes") | table index collecte

I would like to combine the two researches into one, is that possible?

thanks,

0 Karma
1 Solution

numeroinconnu12
Path Finder

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"

View solution in original post

0 Karma

numeroinconnu12
Path Finder

Hello,
The best syntax it's:

index=test_vpn OR index=app_gue toto_VPN_Role="AU_GUE_WEB"
0 Karma

numeroinconnu12
Path Finder

Hello,

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

0 Karma

vnravikumar
Champion

Hi

Try this

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue") 
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")
| table toto_VPN_Role index collecte
0 Karma

numeroinconnu12
Path Finder

Hello @vnravikumar

It works, but I only get the events from the app_gue index but not the events of toto_vpn index .

0 Karma

vnravikumar
Champion

its toto_vpn or test_vpn?

0 Karma

numeroinconnu12
Path Finder

sorry, it's test_vpn.

0 Karma

vnravikumar
Champion

Please check that index is having data for the selected time range.

0 Karma

numeroinconnu12
Path Finder

For the same time range, this search works:
index=test_vpn toto_VPN_Role="AU_GUE_WEB"
|collecte eval=if(action = success, "No", "Yes") | table toto_VPN_Role collecte

0 Karma

vnravikumar
Champion

check this |collecte eval=if(action = success, "No", "Yes") or | eval collecte =if(action = success, "No", "Yes")

0 Karma

numeroinconnu12
Path Finder

it's :

| eval collecte =if(action = success, "No", "Yes") 
0 Karma

vnravikumar
Champion

(index=test_vpn toto_VPN_Role="AU_GUE_WEB") OR (index="app_gue")
| eval collecte =if((action == "success") OR (tag == "success"), "No", "Yes")

0 Karma

numeroinconnu12
Path Finder

it's the same, not event of : (index=test_vpn toto_VPN_Role="AU_GUE_WEB")

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...