SPL query

[manjunath_n]

How to combine the events from 2 different indexes and display the results in a table, when there are no matching fields in the indexes. Please suggest.

[manjunath_n]

Trying to retrieve the correlationId from two different indexes and then use a table to show them.

correlationId field is present in index called abc and properties.correlationID is present in index called cde

Example:

index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* | table correlationId,properties.correltionId

when tried using above we are getting values for correlationId only

[isoutamo]

Hi

you could try this

index=abc OR index=cde sourcetype=json OR sourcetype=_json correlationId="*" OR properties.correlationId=* 
| eval correlationId = coalesce(correlationId, properties.correlationId)
| stats values(*) as * by correlationId

Just  replace "values(*) as *" by all "values(field1) as field1" as you need. You can also use join id needed. The correct way to do this is depending what is your real need.

r. Ismo

[PickleRick · Accepted solution]

As the guys already said, it all boils down to what you mean by "combine".

You might simply do a search across two indexes.

 You can use append, appendcols or multisearch.

Depends on what you want to achieve.

[ITWhisperer]

You can append the search from one index to the search from the other index. The column in the table which don't have values from one index won't have values or you could use appendcols where the results from the second search are put alongside the results from the first search without correlating the results. Having said that, you are likely to have at least one common field, the timestamp field _time so you could use that to correlate the events from the two indexes?

[gcusello]

Hi @manjunath_n,

reading your question, the only answer should be: it isn't possible!

but, I'm sure that it's different!

if you could share more informations maybe we could halp you.

e.g. share some samples of both the indexes to join and understand the result you would have could be a good starting point.

Ciao.

Giuseppe