compare find missing values from two indexes same field heading /name

[learningnow]

Trying to create a report using two indexes on same field "Pcname".
Different datatype one of from Active Directory and other one is from SCCM.
Same computer are present in both indexes

see also the attach screen short.

Desire results:

• If missing form for either Index or not reported back in last 30 days
• nice it have one report but if not possible then we can break in 2 reports or more if needed

Thanks in advance

[jkat54]

Something like this:

index=ad OR index=sccm 
| eval pcName=coalesc(pcname_field_in_AD_index, pcname_field_in_SCCM_index)
| eval lastContact=coaslesc(lastContact_field_in_AD_index, lastContact_field_in_SCCM_index)
| fillnull value="missing"
| stats latest(lastContact) as lastContact by pcName index
| eval comments="Logic for missing / over 30 days goes here"

[learningnow]

Thanks let me try if this would work