compare two different fields from different indexes and return a third field if matched

[ialahdal]

What I am trying to achieve is as follows:
Index=1 client_ip=10.10.10.10 host=Test1
Index=2 ip=10.10.10.10 port=7551

Based on the above I'd like to run a search that will return values of "host" and "port" in a table if client_ip=ip

I have tried join index=1 client_ip=* |rename client_ip as ip|join type=inner ip [search index=2 |stats values(ip) by host]

[to4kawa]

(index=1 client_ip=*) OR (index=2 ip=*)
| eval IP=coalesce(ip,client_ip)
| stats values(host) as host values(port) as port dc(index) as check by IP
| where check > 1

Hi, @ialahdal
please try this.