How to join or lookup results from one search to another for table output?

[GeorgeStarkey]

in the vmware app the following pieces exist

index=vmware-perf
moid mem_used mem_committed

index=vmware-inv
moid changeSet.name

changeset.name is the actual hostame of the vm's so endusers can easily identify.

I want to run something like this:
index=vmware-perf sourcetype=vmware:perf:mem moid=vm* | eval overuse=mem_committed-mem_used | stats min(overuse) by moid,mem_committed,mem_used | dedup moid

HOWEVER I then want to join (or lookup/remap) the changeSet.name from the other index based on the moid so that I can end up with a table that shows:

changeSet.name moid mem_committed mem_used overuse
host1 vm-5619 65222 32001.238281 33220.761719
host2 vm-822 65138 35497.636719 29640.363281
etc..

This is probably a simple join, but I can't quite get it to function

[GeorgeStarkey · Accepted solution]

I have solved this myself with:

index=vmware-perf
sourcetype=vmware:perf:mem moid=vm*
mem_committed>1 | join moid [search
index=vmware-inv moid=*
changeSet.name=vm*] | eval
overuse=mem_committed-mem_used | stats
min(overuse) by
changeSet.name,moid,mem_committed,mem_used
| dedup moid

though this is still very slow. there must be a faster way.

[mipeters_splunk]

the faster way would be to use data models and use the |tstats command with summariesonly. Good luck !!!!