Join help, please somone

[kunalbangia]

Search query one:
sourcetype="aws:description" | table instance_id, volume_id | dedup volume_id
Search query two
aws-description-resource( (aws_account_id="*") , (region="*") , "ebs_snapshots")| table volume_id, snapshot_id, tag_value | dedup volume_id

Volume Id is same in both, how do I join it? so I can get instance_id,volume_id, tag_value and stats count (snapshot_id) all in one table.

[woodcock]

Try this:

(index="foo" AND sourcetype="aws:description") OR (index="bar" AND `aws-description-resource( (aws_account_id="*") , (region="*") , "ebs_snapshots")`
| table instance_id volume_id snapshot_id tag_value
| stats values(*) AS * BY volume_id