I am trying to create a search in which I'm using 2 different indexes, and want to produce and combined result as a table. The table should have some fields from both the indexes. There is one filed in both the indexes, with the same name, so I can't pull results from that field.
index 1 has a filed called URL and index 2 has a filed also called URL. I want to change the name of the field in one index, eg: URL to URL_1 for index 1.
index=index1 OR index=index2
| eval URL2=if(index="index2",URL,null)
| eval URL=if(index="index1",URL,null)
Hi @Godspeed_74
use eval condition:
eval url_1=if(index=index1,url,"")