Eg
eg in fuse.log I have a entry like  userId=abc
while in access.log i have entry like sessionid-12232 | abc | xyz
Output I want is like 
abc | xyz | sessionid-12232
Can you please suggest how can i join these two using pattern
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.
source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
| makeresults
| eval _raw="userId=abc,session=123,time=12:00_IST"
| kv
| eval time=replace(time,"_"," ")
| append 
    [| makeresults 
    | eval _raw="foo-abc-12:00 IST-data" ]
`comment("this is sample data")`
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userId 
| eval session="sessionid-".session
| table userId user session
I uased @richgalloway 's query, thanks.
 source=fuse.log OR source=access.log 
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userid 
| eval session="sessionid-".session
| table userid user sessionid
How about this?
Thanks @richgalloway @to4kawa
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.
source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid
hey, Thank you very much for the response but the scenario is little different
in fuse.log I have fields like 
userId=abc | session=123 | time=12:00 IST
so splunk is able to concider then as 3 fields i.e. userId,session,time
while in access.log i only have values but not field name i.e 
foo-abc-12:00 IST-data
What  I need to achieve is get the userid from fuse.log and find that id in access.log and print userid |session | data
 
					
				
		
 
		
		
		
		
		
	
			
		
		
			
					
		This information should have been included in the question.
@to4kawa's answer should do the job.
