Knowledge Management

Merge Statistics of 2 Indexes

TylerJVitale
Explorer

If I have one index that pairs host with application data, and another index that pairs host with statistical values like cpu %, memory, etc., how do I merge the indices so that a search like host=host1 application=app|stats avg(cpu) would work?

Tags (1)
0 Karma

skoelpin
SplunkTrust
SplunkTrust

Like this

(index=A OR index=b)
| stats max() by <common_field>
0 Karma

TylerJVitale
Explorer

@skoelpin I would like to do something like |stats max() by application though, and "application" is not a common field.

0 Karma