Hi,
I am using 2 indexes (index1 and index2). I want to pull a field from index1 (URL and rename it to url_1), and the in a subsearch I want to pull more fields from index 2. At the end I want a table with the field from index1(url_1) and the fields from index2.
Hi @Godspeed_74
try this:
index=index1 OR index=index2
| eval url_1=if(index=index1,url, "")
| table url_1 (and all the list from the index2)