Splunk Search

Choose either of the available field from multiple queries

arnavzz
New Member

I am trying to search on two indices. Both of them have a field which represents time. But in one index, that field is labelled Ta, while in the other index it's labelled Tt. After the result of the search, I wish to run a stats p95 command on that field. Since either, both fields might turn up in the result, I want it to give me stat p95 for both if both fields are available or just whichever one is returned. Is there a way to do this? Any example will be of great help.

0 Karma

to4kawa
Ultra Champion
index=A OR index=B
| eval common=coalesce(Ta,Tt)
| stats p95(common) dc(index) as flag by common
| where flag > 1
0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...