I have 2 indexes: index1 and index2. I need to compare values in both indexes and show only differences in fields. In both indexes always exist the same field - time, so I need match by this field.
For example:
Index1
Time - 26.11.20
Field1 - xxxx
Field2 - xxxx
and
Index2
Time - 26.11.20
Field1 - xxxx
Field2 - xxxy
I want to get a table:
Field2 - xxxx
Field2 - xxxy
| makeresults
| eval Time="26.11.20",Field1="xxxx",Field2="xxxx"
| appendpipe [eval Time="26.11.20",Field1="xxxx",Field2="xxxy"]
| rename COMMENT as "From here, the logic"
| untable Time Field Value
| stats values(Value) as Value by Time Field
| where mvcount(Value)=2
| xyseries Time Field Value