Hi
I'm new on Splunk
It's possible to give an alias to a search?
I'm trying to do something like this:
index=Obs1 AS A or index= sourcetype =OBS2 AS B | eval mynormalizesidField=(If(index=="A",ID,ID))
What is the best way to give an alias to a complete search?
↧