If I have 2 different fields that match in 2 indexes, how do I return and merge fields from both indexes?

[lhanich1]

I have googled and searched my little heart out, but I am unsure if I am querying using best practice or if this would even work. But here is what I am trying to do:

Use case example:
AV alert logs to one index, with identifiable field "Computer_Name" then ensure "src_host" field matches "Computer_Name" in another index and then stats various fields within each index.

index=index2 sourcetype=irrelevant2 category!=Other 
| fields Computer_Name, field, field 
[search index=index1 ind_primary_user_business_unit=irrelevant | fields src_host, field, field, field, field, field, field]
| eval host=coalesce(src_host,Computer_Name)
|stats count by host, field from index 1, field from index 1,field from index 2, field from index 2, field from index 2, field from index 2, field from index 2, field from index 2

Thanks as always

[martin_mueller · Accepted solution]

This is basically https://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-jo...

In your case, something like this:

(index=index2 sourcetype=irrelevant2 category!=Other) OR (index=index1 ind_primary_user_business_unit=irrelevant)
| fields Computer_Name, field, field, src_host, field, field, field, field, field, field
| eval combined_host=coalesce(src_host,Computer_Name)
| stats count first(field1) as field1 first(field2) as field2 ... by combined_host

That's assuming each fieldN value is unique / exists only once / you only want one value per host. If you have multiple values for each fieldN, and want multiple result rows, you'll need to provide more details on how that split should happen / how the various events from each index should be linked together.

[lhanich1]

Thank you, clearly I was overthinking!