Dashboards & Visualizations

Two index has same field names, change the name

Godspeed_74
Loves-to-Learn Lots

I am trying to create a search in which I'm using 2 different indexes, and want to produce and combined result as a table. The table should have some fields from both the indexes. There is one filed in both the indexes, with the same name, so I can't pull results from that field.
index 1 has a filed called URL and index 2 has a filed also called URL. I want to change the name of the field in one index, eg: URL to URL_1 for index 1.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=index1 OR index=index2 
| eval URL2=if(index="index2",URL,null)
| eval URL=if(index="index1",URL,null)
0 Karma

aasabatini
Motivator

Hi @Godspeed_74 

 

use eval condition:

 

eval url_1=if(index=index1,url,"")
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...

Cloud Monitoring Console - Unlocking Greater Visibility in SVC Usage Reporting

For Splunk Cloud customers, understanding and optimizing Splunk Virtual Compute (SVC) usage and resource ...

Automatic Discovery Part 3: Practical Use Cases

If you’ve enabled Automatic Discovery in your install of the Splunk Distribution of the OpenTelemetry ...