How to achieve searching multiple indexes with one table?

[mw98]

I'm trying to create a table to view hosts in multiple indexes, and report if they are returning data. 

For example

Host    Index1  Index2   Index3

A           OK            OK

B                              OK            OK

C            OK                              OK

I've been using inputlookups to create a static list of hosts to reference, and appendcols to search indexes for the correct information. However, when used together the data isn't quite matching up like it does when I search separately. Any Suggestions?

[mw98]

My search is something along the lines of this 

|inputlookup serverlist.csv| table server| appendcols [search index=exampleIndex host IN(A B C)| eval statuscheck= if( host = server, "ok", "notok"| table statuscheck]

and then I would repeat the appendcols for another index

[richgalloway · Accepted solution]

About 95% of the time, appendcols is not the right solution to a Splunk problem.  That's because the data doesn't always line up (as you've discovered).

Try this alternative

| tstats count where index=* host=* by host,index 
| eval count=if(count==0, "", "OK")
| xyseries host index count

[mw98]

This is what I was looking for! Thank you

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

[ITWhisperer]

Don't use appendcols?

Without seeing your searches, my guess would be that some of them are not returning results for all the hosts in the same order?