Combining 2 different search results based on fields

[selim]

Hello,

I have 2 different searches for 2 different sourcetypes with field extractions. I'm doing the field extractions for search1 for xml data.

search1:

sourcetype=xmlapp | xmlkv

search2:

sourcetype=app2

I'd like to combine searches in such a way that when field2 from search2 does NOT match any existing field1 from search1, I need to create an alert. Any help is greatly appreciated.

[Ayn · Accepted solution]

I believe something like this should work:

sourcetype=xmlapp | xmlkv | search NOT [search sourcetype=app2 | rename field2 as field1 | fields field1]

[Ayn]

Hi @pramit46, I renamed it because the requirement was that values from field2 in the subsearch would be matched to values of field1 in the main search.

[pramit46]

@Ayn, Can you please explain why did you rename the field2?
I also have the same question as that in Selim's comment. Any help would be appreciated.

[selim]

Thank you. That works for finding the events. So, how do display more fields (e.g. field1, field2, field3 from search#1 and field4, field5 from search#2) to the results so that I can display them in a table (or chart)? I tried fields command but was not successful.