Do you need to correlate the values of fieldA with the values of fieldB somehow? Or just list them in two columns, side by side?
If the latter, then this should work:
index=A OR index=B fieldA=* OR fieldB=* | stats values(fieldA) AS fieldA values(fieldB) AS fieldB
The stats values() will dedup the contents of the respective field. If you don't want to dedup and would prefer to list all values, including duplicates, then try this:
index=A OR index=B fieldA=* OR fieldB=* | stats list(fieldA) AS fieldA list(fieldB) AS fieldB
If you need to actually correlate the values of fieldA with the values of fieldB , then you'll need to identify something they have in common that links events from index A with events from index B. For example, maybe they both have a matching field called UUID . In that case, something like this should work:
index=A OR index=B fieldA=* OR fieldB=* UUID=*| stats values(fieldA) AS fieldA values(fieldB) AS fieldB BY UUID
... View more