Splunk Search

How do you merge events on common field values?

alanzchan
Path Finder

Basically I have two fields, index and sourcetypes.

Index:          Sourcetype:
index1          sourcetypeA
index2          sourcetypeA

How do I merge the values of index on the common field value in source type?

Expected result:

Sourcetype:
sourcetypeA      index1
                 index2
0 Karma

laurie_gellatly
Communicator

Merge - could mean several things.

search index=index1 OR index=index2 | stats count by sourcetype

will do a form of merging but I suspect that's not really what you want?

...Laurie:{)

0 Karma
Get Updates on the Splunk Community!

Easily Improve Agent Saturation with the Splunk Add-on for OpenTelemetry Collector

Agent Saturation What and Whys In application performance monitoring, saturation is defined as the total load ...

Explore the Latest Educational Offerings from Splunk [January 2025 Updates]

At Splunk Education, we are committed to providing a robust learning experience for all users, regardless of ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...