Splunk Search

How to create a table with fields form two different indexes

maryamchar
Explorer

I want to create a table with all fields from two different indexes.

Index=A |rename fieldA as field1 |table field1 fieldAA fieldAB field AC
index= B |rename fieldB as field1 | table field1 fieldBB fieldBC

I want a table shows all fields including common field which is filed1

|table field1 fieldAA fieldAB field AC fieldBB fieldBC

Tags (1)
0 Karma
1 Solution

Vijeta
Influencer

Try something like-

index=A or index=B| eval field1=coalesce(fieldA,fieldB)| stats values(*) as * by field1

View solution in original post

0 Karma

koshyk
Super Champion

Another option is to do using transaction, so the events can be clubbed together

index=A or index=B
| rename fieldA as field1 
| rename fieldB as field1
| transaction field1 
| table field1 fieldAA fieldAB field AC fieldBB fieldBC
0 Karma

maryamchar
Explorer

Thank you! It worked!!

0 Karma

koshyk
Super Champion

thanks. Please upvote if it helped. cheers

0 Karma

maryamchar
Explorer

Sorry but I ran the search now, the table only shows certain values from one index only and ignore the other indexes. Is there a reason for that ? why the table has empty fields even though it exists on data

0 Karma

maryamchar
Explorer

one more question realted to same query above. I want to show the number of count by field1 ? How would I do. that

|stats count by field 1

0 Karma

koshyk
Super Champion

if you do
|stats count by field 1

This will show just count for field1 after clubbing the transaction

if you want to retain the original table and then count, better to do
index=A or index=B
| rename fieldA as field1
| rename fieldB as field1
| transaction field1
| streamstats count as field_count by field
| table field1 field_count fieldAA fieldAB field AC fieldBB fieldBC

0 Karma

Vijeta
Influencer

Try something like-

index=A or index=B| eval field1=coalesce(fieldA,fieldB)| stats values(*) as * by field1
0 Karma

maryamchar
Explorer

Thank you! It worked!

0 Karma

maryamchar
Explorer

if I want to have stats values for certain fields only from both indexes, how would I do that ? Thank you!!

0 Karma
Get Updates on the Splunk Community!

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...