Common Field in Two Different Indexes

[ryanprayacn]

I have two indexes that I can successfully join via stats. However, both indexes have a common field named "STATUS". I want to be able to separate the STATUS field into STATUS1 and STATUS2 before the join - so I can see both. I have left out STATUS below but showing successful join SPL below:

index=customertest OR index=valuetest | stats values(Spend) as spend values(Order) as order by Customer | fillnull value=NULL | mvexpand spend | sort Customer

Any recommendations?

[DalJeanis · Accepted solution]

Try this...

index=customertest OR index=valuetest 
| eval Status1=case(index="customertest", Status)
| eval Status2=case(index="valuetest", Status)
| stats values(Spend) as spend values(Order) as order values(Status*) as Status* by Customer 
| fillnull value=NULL 
| mvexpand spend 
| sort Customer

[ryanprayacn]

Thanks this worked!