Basically I have two fields, index and sourcetypes.
Index: Sourcetype:
index1 sourcetypeA
index2 sourcetypeA
How do I merge the values of index on the common field value in source type?
Expected result:
Sourcetype:
sourcetypeA index1
index2
Merge - could mean several things.
search index=index1 OR index=index2 | stats count by sourcetype
will do a form of merging but I suspect that's not really what you want?
...Laurie:{)