Splunk Search

Subsearch with different index

Godspeed_74
Loves-to-Learn Lots

Hi,
I am using 2 indexes (index1 and index2). I want to pull a field from index1 (URL and rename it to url_1), and the in a subsearch I want to pull more fields from index 2. At the end I want a table with the field from index1(url_1) and the fields from index2. 

Labels (2)
0 Karma

aasabatini
Motivator

Hi @Godspeed_74 

try this:

index=index1 OR index=index2
| eval url_1=if(index=index1,url, "")
| table url_1 (and all the list from the index2)
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...