Splunk Search

Choose either of the available field from multiple queries

New Member

I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.

0 Karma

index=A OR index=B
| eval common=coalesce(Ta,Tt)
| stats p95(common) dc(index) as flag by common
| where flag > 1
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!