I have two different indexes that have different fields name which are actually the same thing:
Index 1 has: IPV4_SRC_ADDR : "220.127.116.11"
Index 2 has: source.addr: "18.104.22.168"
I cannot modify the index but I can work on the index pattern. Is there a way that I can create an additional field to filter on to click and get the only results from that ip?
Tried with scripted fields but did not work.