How can I get eventstats to recognize a renamed field?

[rlough]

Hi,

I've been having some trouble grouping same fields from multiple sources when the field names are different. I have two sources that have the same field, but different names and I simply want to table a list of all of those names that are present in both.

For example my search looks something like this:

index=ind (source=src1.log "TAG") OR (source=src2.log ANOTHERTAG) | rex field=_raw mode=sed "s/UserID/nameID/g" | eventstats count(eval(source=="src1.log")) AS src1Count count(eval(source==src2.log)) AS src2Count by nameID | where src1Count > 0 OR src2Count > 0 | table nameID

When the field names are the same and I do not have to include rex field=_raw mode=sed "s/UserID/nameID/g" in the query, it works great! However, the above just returns no events or stats. I have also tried the rename command with no luck.

Thanks in advance!

Note: I definitely want to avoid using subsearch if at all possible.

[rsennett_splunk · Accepted solution]

You're gonna want to take a look at this moving forward:
Common Information Model Add-On

Personally, I would use Field Alias. settings>field>field alias.
You can apply an alias to source, sourcetype or host.
It won't be clear in your search that you used an alias, but it certainly helps when it's something you'll use over and over again.