Hello,
I am looking at two indexes with the same field, "hostname".
I am looking to create a table of the hostname values that exist in both index1 and index2. Could someone please assist with this search? Thank you
Something like this:
index=index1 OR index=index2
| stats count by index,hostname
Or:
index=index1 OR index=index2
| stats values(hostname) by index
Or:
index=index1 OR index=index2
| chart count over hostname by index
If you have a specific output in mind, please share a mockup of what you want the output to look like.