Multi Index Data Sample

[brownbill]

If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in the right direction I would be grateful!

Splunk>Hunk Version:
7.2.9.1

[brownbill]

Thanks everyone for the help. Question I would like to group the multiple DSLAM_NODE_NAMES together instead of having to searching for them in the table. So maybe like the highest hit be at the top. Any thoughts? Below is what I have that is working for the first part.

index=iptv_hist sourcetype=rx_session_v2
| append [search index=poll_dslam sourcetype=poll_dslam_inventory
| fields CKTID_OR_TN, DSLAM_NODE_NAME, CODE4]
| stats last(DSLAM_NODE_NAME) as DSLAM_NODE_NAME, last(CODE4) as CODE4 by CKTID_OR_TN
| table CKTID_OR_TN, DSLAM_NODE_NAME, CODE4
| dedup CODE4, DSLAM_NODE_NAME
| rename CODE4 as "Closing Codes", CKTID_OR_TN as "BTN", DSLAM_NODE_NAME as "DSLAM CLLI"

[woodcock · Accepted solution]

Like this

index=phoneAndDeviceName OR index=phoneAndResolutionCode
| fields phone deviceName resolutionCode
| stats values(*) AS * BY phone

[manjunathmeti]

Try this. Fields name for telephone number should be same in index 1 and 2. If not, just rename it using rename command.

index=Index 1 | append [ search index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field] | stats last(device_name_field) as device_name, last(resolution_code_field) as resolution_code by telephone_number_field

[brownbill]

Thanks very much for the help! I do have one issue though. The telephone number and device name shows up and matches, however the resolution code does shows up at the top of table but doesn't display any of the data in the fields. Any thoughts?

[manjunathmeti]

try this:

index=Index 1 OR index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field | stats last(device_name_field) as device_name, max(resolution_code_field) as resolution_code by telephone_number_field