SITUATION: - I use indices "A" and "B" to come to answer the same question but for different environments. - Each index has unique fields names but said fields represent the same data in each index. - I want a table to answer the same question in one table using both indices. - I'm starting with SPL similar to this:
(index=A AND indexA_unqiue_field=x) OR (index=B AND sourcetype=v indexB_unique_field=y)
| rename indexA_unqiue_field AS field
| rename indexB_unique_field AS field
| table _time, field, index
PROBLEM: - With the above SPL I am failing to answer the same question using the 2 indices. It appears to work fine for index B but "field" does not populate for Index A.
QUESTION: - How do I get all fields to populate? - Or how may I achieve the goal?