Dashboards & Visualizations

Multi Index Data Sample

brownbill
New Member

If telephone number is present in both Index 1 and Index 2 display the associated device name from the event in index 2 and then display resolution code from index 2. If anyone could point me in the right direction I would be grateful!

Splunk>Hunk Version:
7.2.9.1

Labels (1)
0 Karma
1 Solution

woodcock
Esteemed Legend

Like this

index=phoneAndDeviceName OR index=phoneAndResolutionCode
| fields phone deviceName resolutionCode
| stats values(*) AS * BY phone

View solution in original post

0 Karma

brownbill
New Member

Thanks everyone for the help. Question I would like to group the multiple DSLAM_NODE_NAMES together instead of having to searching for them in the table. So maybe like the highest hit be at the top. Any thoughts? Below is what I have that is working for the first part.

index=iptv_hist sourcetype=rx_session_v2
| append [search index=poll_dslam sourcetype=poll_dslam_inventory
| fields CKTID_OR_TN, DSLAM_NODE_NAME, CODE4]
| stats last(DSLAM_NODE_NAME) as DSLAM_NODE_NAME, last(CODE4) as CODE4 by CKTID_OR_TN
| table CKTID_OR_TN, DSLAM_NODE_NAME, CODE4
| dedup CODE4, DSLAM_NODE_NAME
| rename CODE4 as "Closing Codes", CKTID_OR_TN as "BTN", DSLAM_NODE_NAME as "DSLAM CLLI"

0 Karma

woodcock
Esteemed Legend

Like this

index=phoneAndDeviceName OR index=phoneAndResolutionCode
| fields phone deviceName resolutionCode
| stats values(*) AS * BY phone
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Try this. Fields name for telephone number should be same in index 1 and 2. If not, just rename it using rename command.

index=Index 1 | append [ search index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field] | stats last(device_name_field) as device_name, last(resolution_code_field) as resolution_code by telephone_number_field
0 Karma

brownbill
New Member

Thanks very much for the help! I do have one issue though. The telephone number and device name shows up and matches, however the resolution code does shows up at the top of table but doesn't display any of the data in the fields. Any thoughts?

0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

try this:

index=Index 1 OR index=Index 2 | fields telephone_number_field, device_name_field,  resolution_code_field | stats last(device_name_field) as device_name, max(resolution_code_field) as resolution_code by telephone_number_field
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...