How do I build a search that compares 2 different indexes with 2 identical values?

[itzikshviro]

Hi guys,

I need to build a search that compares 2 different indexes.

search 1 - index=indexname1 suser=username act=select
search 2 - index=indexname2 duser=username act=select

I need to compare the time stamp between the field values "suser" and "duser" (the value of "suser" and "duser" results in the same username).

Also, both indexes have the values "suser" and "duser", so it's kind of confusing.

I would like to display it on the same table.

Anyone knows how to accomplish that?

Your help would be highly appreciated.

[richgalloway]

See if this helps.

(index=indexname1 suser=username act=select) OR (index=indexname2 duser=username act=select) 
| eval user=coalesce(suser, duser) 
| stats range(_time) by user

[ssadanala1]

Give it a shot

index=indexname1 | eval suser=user |table _time user act| eval first=_time |appendcols [ search index=indexname1 | eval duser=user | eval last=_time|table _time last act] | stats values(*) as * by user .

Please let know