Splunk Search

Choose either of the available field from multiple queries

arnavzz
New Member

I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.

0 Karma

to4kawa
Ultra Champion
index=A OR index=B
| eval common=coalesce(Ta,Tt)
| stats p95(common) dc(index) as flag by common
| where flag > 1
0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...