How do you display two sources from one Index with different fields?

[egt]

I want to display from two sources from one Index with different fields via a key value in the result fields from both sources. is that possible?

Example:
source 1 contains the following fields: Id, function, serial number,...

source2 contains these fields: Id, leasing_end, leasing_start;....

The ID field contains the key value.

The result should show which devices on a certain date have leasing end divided by function

Translated with www.DeepL.com/Translator

[renjith_nair · Accepted solution]

@egt,

Another way is to use stats

index="your index" (source="source1" OR source="source2") |fields id,function,serial_number, leasing_end, leasing_start
|stats values(*) as * by id

Now you should be able to do further processing/checks on the data.
e.g.

Events(dummy)

|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end

Final result

|makeresults count=6|streamstats count as row|eval id=if(row<4,row,row-3)
|eval function=if(row<4,"func".id,"")|eval serialno=if(row<4,"sn".id,"")
|eval leasing_start=if(row>3,id."-11-2018",""),leasing_end=if(row>3,id."-12-2018","")
|fields _time,id,function,serialno,leasing_start,leasing_end
|stats values(*) as * by id

[kmaron]

you can do that with a join - https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Join