Splunk Search

How do I display fields in two separate indexes

epeeran
Observer

I have two separate indexes for example index A and index B. I need to display one field from index A and one field from index B in columns for each field next to each other. These two fields are NOT related but entirely different

Please kindly help?

Tags (1)
0 Karma

elliotproebstel
Champion

Do you need to correlate the values of fieldA with the values of fieldB somehow? Or just list them in two columns, side by side?
If the latter, then this should work:

index=A OR index=B fieldA=* OR fieldB=* | stats values(fieldA) AS fieldA values(fieldB) AS fieldB

The stats values() will dedup the contents of the respective field. If you don't want to dedup and would prefer to list all values, including duplicates, then try this:

index=A OR index=B fieldA=* OR fieldB=* | stats list(fieldA) AS fieldA list(fieldB) AS fieldB

If you need to actually correlate the values of fieldA with the values of fieldB, then you'll need to identify something they have in common that links events from index A with events from index B. For example, maybe they both have a matching field called UUID. In that case, something like this should work:

index=A OR index=B fieldA=* OR fieldB=* UUID=*| stats values(fieldA) AS fieldA values(fieldB) AS fieldB BY UUID

0 Karma

MuS
Legend

Hi epeeran,

basically you can do something like this:

index=a OR index=b
| eval id=coalesce(fieldA, fieldB)
| stats values(*) AS * by id

This will take either values from fieldA or fliedB as id and the stats will group everything by id.
You can also read this answer https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo... to learn more about this topic.

Hope this helps ...

cheers, MuS

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...