search different index

[splunkcol]

I have 3 different indexes and they asked me to search by document number.

The structure of the logs is different including the name of the field that contains the document number

index = index1 OR index = index2 OR index = index3 1234567

As you know, that query is limited to looking for the number 1234567

I can't tell it to show certain fields in a table using table or stats count.

Any suggestion?

[kamlesh_vaghela]

@splunkcol 

If you know the document number filed name from each index then you can try this also.

(index=index1 document_number_Field1="1234567") OR (index=index2 document_number_Field2="1234567") OR (index=index3 document_number_Field3="1234567")
 | eval document_number = coalesce(document_number_Field1,document_number_Field2,document_number_Field3)
| .
.
.

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.

[gcusello · Accepted solution]

Hi @splunkcol,

i the name of the field in the three indexes is number1, numer2 and number3

You could use a search like this:

index = index1 OR index = index2 OR index = index3 
| eval number=coalesce(number1, number2, number3)
| where number=1234567
| ...

With this approach you can also correlate the three indexes taking data from all the indexes.

Ciao.

Giuseppe