Splunk Search

Choose either of the available field from multiple queries

arnavzz
New Member

I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.

0 Karma

to4kawa
Ultra Champion
index=A OR index=B
| eval common=coalesce(Ta,Tt)
| stats p95(common) dc(index) as flag by common
| where flag > 1
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!