Dashboards & Visualizations

Two index has same field names, change the name

Godspeed_74
Loves-to-Learn Lots

I am trying to create a search in which I'm using 2 different indexes, and want to produce and combined result as a table. The table should have some fields from both the indexes. There is one filed in both the indexes, with the same name, so I can't pull results from that field.
index 1 has a filed called URL and index 2 has a filed also called URL. I want to change the name of the field in one index, eg: URL to URL_1 for index 1.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index=index1 OR index=index2 
| eval URL2=if(index="index2",URL,null)
| eval URL=if(index="index1",URL,null)
0 Karma

aasabatini
Motivator

Hi @Godspeed_74 

 

use eval condition:

 

eval url_1=if(index=index1,url,"")
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
Get Updates on the Splunk Community!

Community Content Calendar, November Edition

Welcome to the November edition of our Community Spotlight! Each month, we dive into the Splunk Community to ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...