Splunk Search

Create One Field Value from two indexes

katzr
Path Finder

Hello,

I have index=A with values from January-April with the field value called EmailA. I have another index with values from May-June with a field value called EmailB. I need to look at the most frequent Emails from January to June. This is the search I am using but it is not combining the emails correctly- the field Email is pulling only from Index=A since I renamed that one last. An email could be used in January and June and I need to have the total count across both indexes.

index =A OR index =B NOT source = 433 | eval EmailA=lower(EmailA)| eval EmailB =lower(EmailB) | rename EmailB as Email | rename EmailA as Email | stats count by Email

And I am running this search with the time picker set from January to June. Thank you for the help!

0 Karma
1 Solution

s2_splunk
Splunk Employee
Splunk Employee

Try this: index =A OR index =B NOT source = 433 | eval Email=coalesce(EmailA,EmailB) | stats count by Email
Field values are not case-sensitive in Splunk, but if you want them lower case, you can wrap the coalesce in a lower() function.

View solution in original post

s2_splunk
Splunk Employee
Splunk Employee

Try this: index =A OR index =B NOT source = 433 | eval Email=coalesce(EmailA,EmailB) | stats count by Email
Field values are not case-sensitive in Splunk, but if you want them lower case, you can wrap the coalesce in a lower() function.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...