I have 3 different indexes and they asked me to search by document number.
The structure of the logs is different including the name of the field that contains the document number
index = index1 OR index = index2 OR index = index3 1234567
As you know, that query is limited to looking for the number 1234567
I can't tell it to show certain fields in a table using table or stats count.
Any suggestion?
Hi @splunkcol,
i the name of the field in the three indexes is number1, numer2 and number3
You could use a search like this:
index = index1 OR index = index2 OR index = index3
| eval number=coalesce(number1, number2, number3)
| where number=1234567
| ...
With this approach you can also correlate the three indexes taking data from all the indexes.
Ciao.
Giuseppe
If you know the document number filed name from each index then you can try this also.
(index=index1 document_number_Field1="1234567") OR (index=index2 document_number_Field2="1234567") OR (index=index3 document_number_Field3="1234567")
| eval document_number = coalesce(document_number_Field1,document_number_Field2,document_number_Field3)
| .
.
.
Thanks
KV
▄︻̷̿┻̿═━一
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.
Hi @splunkcol,
i the name of the field in the three indexes is number1, numer2 and number3
You could use a search like this:
index = index1 OR index = index2 OR index = index3
| eval number=coalesce(number1, number2, number3)
| where number=1234567
| ...
With this approach you can also correlate the three indexes taking data from all the indexes.
Ciao.
Giuseppe