Dashboards & Visualizations

Multi Index Data Sample

brownbill
New Member

If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in the right direction I would be grateful!

Splunk>Hunk Version:
7.2.9.1

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this

index=phoneAndDeviceName OR index=phoneAndResolutionCode
| fields phone deviceName resolutionCode
| stats values(*) AS * BY phone

View solution in original post

0 Karma

brownbill
New Member

Thanks everyone for the help. Question I would like to group the multiple DSLAM_NODE_NAMES together instead of having to searching for them in the table. So maybe like the highest hit be at the top. Any thoughts? Below is what I have that is working for the first part.

index=iptv_hist sourcetype=rx_session_v2
| append [search index=poll_dslam sourcetype=poll_dslam_inventory
| fields CKTID_OR_TN, DSLAM_NODE_NAME, CODE4]
| stats last(DSLAM_NODE_NAME) as DSLAM_NODE_NAME, last(CODE4) as CODE4 by CKTID_OR_TN
| table CKTID_OR_TN, DSLAM_NODE_NAME, CODE4
| dedup CODE4, DSLAM_NODE_NAME
| rename CODE4 as "Closing Codes", CKTID_OR_TN as "BTN", DSLAM_NODE_NAME as "DSLAM CLLI"

0 Karma

woodcock
Esteemed Legend

Like this

index=phoneAndDeviceName OR index=phoneAndResolutionCode
| fields phone deviceName resolutionCode
| stats values(*) AS * BY phone
0 Karma

manjunathmeti
Champion

Try this. Fields name for telephone number should be same in index 1 and 2. If not, just rename it using rename command.

index=Index 1 | append [ search index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field] | stats last(device_name_field) as device_name, last(resolution_code_field) as resolution_code by telephone_number_field
0 Karma

brownbill
New Member

Thanks very much for the help! I do have one issue though. The telephone number and device name shows up and matches, however the resolution code does shows up at the top of table but doesn't display any of the data in the fields. Any thoughts?

0 Karma

manjunathmeti
Champion

try this:

index=Index 1 OR index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field | stats last(device_name_field) as device_name, max(resolution_code_field) as resolution_code by telephone_number_field
0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...