Dashboards & Visualizations

Two index has same field names, change the name

Godspeed_74
Loves-to-Learn Lots

I am trying to create a search in which I'm using 2 different indexes, and want to produce and combined result as a table. The table should have some fields from both the indexes. There is one filed in both the indexes, with the same name, so I can't pull results from that field.
index 1 has a filed called URL and index 2 has a filed also called URL. I want to change the name of the field in one index, eg: URL to URL_1 for index 1.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=index1 OR index=index2 
| eval URL2=if(index="index2",URL,null)
| eval URL=if(index="index1",URL,null)
0 Karma

aasabatini
Motivator

Hi @Godspeed_74 

 

use eval condition:

 

eval url_1=if(index=index1,url,"")
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...