multifield key between indexes

[kp_pl]

index=db OR index=app
| eval join=if(index="db",processId,pid)
| stats sum(rows) sum(cputime) by join

Above is simple example how to join two indexes. But how to join two indexes where the key value has two fields ?

K.

[gcusello]

Hi @kp_pl ,

yes, it's correct.

I'd use coalesce instead if:

index IN (db, app)
| eval key=coaesce(processId,pid)
| stats sum(rows) AS rown sum(cputime) AS cputime by key

Ciao.

Giuseppe

[kp_pl]

I suppose you do not understand my question . 

I need a join two indexes by two fields , Something like

| eval key=if(index="aaa", I1key1 , I2key1)
| eval key2=if(index="aaa", I1key2 , I2key2)
| stats values(*) as * by (key and  key2)

[gcusello]

Hi @kp_pl ,

I understood that you have key1 in ndex1 and key2 in index2 and you want to correate events from both the indexes.

using coalesce, you create a new field (caed key) that takes values from index1 (when present key1) or otherwise from index2 (key2).

then you correlate values using stats and you have values from both the indexes.

Ciao.

Giuseppe

[kp_pl]

everything you write is correct but it is not my case. 
Below my indexes with keys:
index1:  AAA
key values:  fieldA1 AND fieldA2

index2 : BBB
key values: fieldB1 AND fieldB2

so I suppose I need to do something like

| eval JOIN=if (index='AAA', fieldA1+"_"+fieldA2, fieldB1+"_"+fieldB2)

or in your way:

| eval key=coalesce(fieldA1+"_"+fieldA2 , fieldB1+"_"+fieldB2)

btw. In a few sources close to splunk I read IF is more efficient than COALESCE .   But of course both methods do more or less the same.

[gcusello]

Hi @kp_pl ,

yes, coalesce and if are the same, even if I always use coalesce.

I usually use "." instead "+".

let me summarize: for events from index A, you want to use to concatenated fields from this index, otherwise

two concatenated fieds from index B, is it correct?

in this case you could use:

| eval key=coalesce(fieldA1."_".fieldA2, fieldB1."_".fieldB2)

or in your way:

| eval JOIN=if(index="AAA", fieldA1."_".fieldA2, fieldB1."_".fieldB2)

let me know.

Ciao.

Giuseppe