Splunk search on two different indexes and retrieve a matching value from one index

[armanih]

Hi All,

I have two indexes.

Index A | table email_users
Index B | table email, Group

email_users and email fields contain email addresses

I need to match both these index fields and get the value of the field Group for the results.

I tried the below query, but its not working.

index=A or index=B
| rename email_users as email
| stats values(Group) by email

[thambisetty]

index=A or index=B
| eval new_email=coalesce(email,email_users)
| stats dc(index) as dc_index values(Group) as values_Group by new_email
| where dc_index=2

values_Group is just renaming values(Group).

Run the above query to see matching results. 

[thambisetty]

index=A or index=B
| eval new_email=coalesce(email,email_users)
| stats values(Group) as values_Group by new_email

to return only matched values use below query:

index=A or index=B
| eval new_email=coalesce(email,email_users)
| stats dc(index) as dc_index values(Group) as values_Group by new_email
| where dc_index=2

[armanih]

Thanks @thambisetty 

Can you please explain what is values_Group in stats command 
" | stats values(Group) as values_Group by new_email " 

The query is not working. I am only getting the list of emails and not the groups. 

thanks