Splunk Search

Common Field in Two Different Indexes

Explorer

I have two indexes that I can successfully join via stats. However, both indexes have a common field named "STATUS". I want to be able to separate the STATUS field into STATUS1 and STATUS2 before the join - so I can see both. I have left out STATUS below but showing successful join SPL below:

index=customertest OR index=valuetest | stats values(Spend) as spend values(Order) as order by Customer | fillnull value=NULL | mvexpand spend | sort Customer

Any recommendations?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this...

index=customertest OR index=valuetest 
| eval Status1=case(index="customertest", Status)
| eval Status2=case(index="valuetest", Status)
| stats values(Spend) as spend values(Order) as order values(Status*) as Status* by Customer 
| fillnull value=NULL 
| mvexpand spend 
| sort Customer

View solution in original post

SplunkTrust
SplunkTrust

Try this...

index=customertest OR index=valuetest 
| eval Status1=case(index="customertest", Status)
| eval Status2=case(index="valuetest", Status)
| stats values(Spend) as spend values(Order) as order values(Status*) as Status* by Customer 
| fillnull value=NULL 
| mvexpand spend 
| sort Customer

View solution in original post

Explorer

Thanks this worked!