Create One Field Value from two indexes

[katzr]

Hello,

I have index=A with values from January-April with the field value called EmailA. I have another index with values from May-June with a field value called EmailB. I need to look at the most frequent Emails from January to June. This is the search I am using but it is not combining the emails correctly- the field Email is pulling only from Index=A since I renamed that one last. An email could be used in January and June and I need to have the total count across both indexes.

index =A OR index =B NOT source = 433 | eval EmailA=lower(EmailA)| eval EmailB =lower(EmailB) | rename EmailB as Email | rename EmailA as Email | stats count by Email

And I am running this search with the time picker set from January to June. Thank you for the help!

[s2_splunk · Accepted solution]

Try this: index =A OR index =B NOT source = 433 | eval Email=coalesce(EmailA,EmailB) | stats count by Email
Field values are not case-sensitive in Splunk, but if you want them lower case, you can wrap the coalesce in a lower() function.