Can anyone suggest how I can create a join query using pattern

[ayush8878]

Eg
eg in fuse.log I have a entry like userId=abc
while in access.log i have entry like sessionid-12232 | abc | xyz
Output I want is like
abc | xyz | sessionid-12232
Can you please suggest how can i join these two using pattern

[to4kawa]

| makeresults
| eval _raw="userId=abc,session=123,time=12:00_IST"
| kv
| eval time=replace(time,"_"," ")
| append 
    [| makeresults 
    | eval _raw="foo-abc-12:00 IST-data" ]
`comment("this is sample data")`
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userId 
| eval session="sessionid-".session
| table userId user session

I uased @richgalloway 's query, thanks.

 source=fuse.log OR source=access.log 
| rex "(?<user>[^\-]+)-(?<userId>[^\-]+)-(?<time>[^\-]+)-(?<data>.+)"
| stats values(*) as * by userid 
| eval session="sessionid-".session
| table userid user sessionid

How about this?

[ayush8878]

Thanks @richgalloway @to4kawa

[richgalloway · Accepted solution]

Assuming access.log has fields 'sessionid', 'userid', and 'foo' and they're already extracted then this should get you started.

source=fuse.log OR source=access.log | stats values(*) as * by userid | table userid foo sessionid

[ayush8878]

hey, Thank you very much for the response but the scenario is little different
in fuse.log I have fields like
userId=abc | session=123 | time=12:00 IST
so splunk is able to concider then as 3 fields i.e. userId,session,time
while in access.log i only have values but not field name i.e
foo-abc-12:00 IST-data
What I need to achieve is get the userid from fuse.log and find that id in access.log and print userid |session | data

[richgalloway]

This information should have been included in the question.
@to4kawa's answer should do the job.