If I have one index that pairs host with application data, and another index that pairs host with statistical values like cpu %, memory, etc., how do I merge the indices so that a search like host=host1 application=app|stats avg(cpu) would work?
host=host1 application=app|stats avg(cpu)
Like this
(index=A OR index=b) | stats max() by <common_field>
@skoelpin I would like to do something like |stats max() by application though, and "application" is not a common field.
|stats max() by application
