Basically I have two fields, index and sourcetypes.
Index: Sourcetype: index1 sourcetypeA index2 sourcetypeA
How do I merge the values of index on the common field value in source type?
Expected result:
Sourcetype: sourcetypeA index1 index2
Merge - could mean several things.
search index=index1 OR index=index2 | stats count by sourcetype
will do a form of merging but I suspect that's not really what you want?
...Laurie:{)
