hi lohit,
try do this
create a new_index to collect all the data of the two indexes and then execute your request on this new_index as follow.
index="abc" OR index="xyz" |table a b c uri x y z url |collect index=new_index
index=new_index |stats values(a), values(b), values(x),values(y) by url
OR
index="abc" OR index="xyz" |table a b uri x y url |collect index=new_index
index=new_index |eval url=coalesce(url,uri) |stats values(a), values(b), values(x), values(y) by url
try and let me know.
... View more