Splunk search on two different indexes and retrieve a matching value from one index

[armanih]

Hi All,

I have two indexes. 

Index A | table email_users
Index B | table email, Group 

email_users and email fields contain email addresses 

I need to match both these index fields and get the value of the field Group for the results.

I tried the below query, but its not working.

index=A or index=B 
|  rename email_users as email 
| stats values(Group) by email 

[thambisetty]

https://community.splunk.com/t5/Splunk-Enterprise-Security/Splunk-search-on-two-different-indexes-an...