Splunk Enterprise

how to get one of the fields by searching multiple indexes without using OR

sivaranjiniG
Path Finder

example i have multiple indexes like index1, index2, index3. amoung these a field named "Category" presents in index2.

I want to write a query without using OR (index=index1 OR index=index2 OR index=index3), which searches my field "Category" first in index1 then comes to index2 finds the result and doesnt go to index3.
reason being i dont want to load a index after i found my result in previous index. if i go with OR it loads all three indexes in the result.

Someone please help me here..

Labels (1)
0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...