How do I display fields in two separate indexes

[epeeran]

I have two separate indexes for example index A and index B. I need to display one field from index A and one field from index B in columns for each field next to each other. These two fields are NOT related but entirely different

Please kindly help?

[elliotproebstel]

Do you need to correlate the values of fieldA with the values of fieldB somehow? Or just list them in two columns, side by side?
If the latter, then this should work:

index=A OR index=B fieldA=* OR fieldB=* | stats values(fieldA) AS fieldA values(fieldB) AS fieldB

The stats values() will dedup the contents of the respective field. If you don't want to dedup and would prefer to list all values, including duplicates, then try this:

index=A OR index=B fieldA=* OR fieldB=* | stats list(fieldA) AS fieldA list(fieldB) AS fieldB

If you need to actually correlate the values of fieldA with the values of fieldB, then you'll need to identify something they have in common that links events from index A with events from index B. For example, maybe they both have a matching field called UUID. In that case, something like this should work:

index=A OR index=B fieldA=* OR fieldB=* UUID=*| stats values(fieldA) AS fieldA values(fieldB) AS fieldB BY UUID

[MuS]

Hi epeeran,

basically you can do something like this:

index=a OR index=b
| eval id=coalesce(fieldA, fieldB)
| stats values(*) AS * by id

This will take either values from fieldA or fliedB as id and the stats will group everything by id.
You can also read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... to learn more about this topic.

Hope this helps ...

cheers, MuS