I have a problem with my search because I use to different index and the data which I want to compare when I want to define by a field is different for example.
I have two Index
in one I have ContactByName and in the other index I have PerformedByName. I the two fields I have the same data but when I want to compare the data in that information I cant. I try to rename ContactByName as PerformedByName to do my search again but is not a good idea.
I have this Right now:
(index="inlooxtt" StatusName!=Completed StatusName!=Cancelled PerformedByName!=Donado* CreatedDate>2020-05-30 ProjectName!="Capac* General" ProjectName!="Preventas*") OR (index="inlooxtasks" ProjectStatusName!=Completed ProjectStatusName!=Cancelled ContactDisplayName!=Donado* ContactDisplayName!="null" ProjectName!="Capac* General" ProjectName!="Preventas*") | rename ContactDisplayName as PerformedByname | eval Tiempo_Ejecutado=(DurationMinutes/60), Tiempo_Planeado=WorkAmount | stats dedup_splitvals=true sum(Tiempo_Ejecutado) as Tiempo_Ejecutado, sum(Tiempo_Planeado) as Tiempo_Planeado by PerformedByname