Splunk Search

Choose either of the available field from multiple queries

arnavzz
New Member

I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.

0 Karma

to4kawa
Ultra Champion
index=A OR index=B
| eval common=coalesce(Ta,Tt)
| stats p95(common) dc(index) as flag by common
| where flag > 1
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...