Splunk Search

How to edit my search to get a table of data from multiple indexes?

carlpier
Explorer

Hello,

I’m looking for to get a table from the the search results from two indexes:

index="imwaccesslog" OR index="nbdrest-performance" 
sourcetype=IMWAccessLog OR sourcetype="PerfNBDCustomTSV" 
URI="/nbd-rest/rest/nbd/inquiry/Inquiry/getUtente" OR Service="DBInquiryServiceImpl.estraiRapportiUtente" 
| stats max(ETsec) as m_LOG max(ETms) as m_PERF | table URI, m_LOG, Service, m_PERF

The result I'm currently getting is:

URI m_LOG   Service m_PERF
     4.681               63

The result I would like to get:

URI                                       m_LOG Service                                m_PERF
/nbd-rest/rest/nbd/inquiry/Inquiry/getUtente 4.681 DBInquiryServiceImpl.estraiRapportiUtente 63

Thanks in advance for the assistance.

0 Karma

Raghav2384
Motivator
try 

stats max(ETsec) as m_LOG ,max(ETms) as m_PERF by URI,Service,_time | table URI, m_LOG, Service, m_PERF

thanks,
Raghav
0 Karma

markthompson
Builder

Try this:
(index="imwaccesslog" AND sourcetype=IMWAccessLog) OR (index="nbdrest-performance" AND sourcetype="PerfNBDCustomTSV" )

0 Karma

carlpier
Explorer

I'm sorry, but the result is' still the same as the previous:

URI m_LOG Service m_PERF
4.681 63

fields URI and Service are not valued

thank you for what you can do

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...