I have two different indexes that have different fields name which are actually the same thing:
Index 1 has: IPV4_SRC_ADDR : "126.96.36.199"
Index 2 has: source.addr: "188.8.131.52"
I cannot modify the index but I can work on the index pattern. Is there a way that I can create an additional field to filter on to click and get the only results from that ip?
Tried with scripted fields but did not work.