If I have one index that pairs host with application data, and another index that pairs host with statistical values like cpu %, memory, etc., how do I merge the indices so that a search like host=host1 application=app|stats avg(cpu)
would work?
Like this
(index=A OR index=b)
| stats max() by <common_field>
@skoelpin I would like to do something like |stats max() by application
though, and "application" is not a common field.