Combining 3 big searches

[Zenun]

I am working on project to compare ip and MAC  whether they are seen from three different tool. Tanium, ACAS, HBSS.

Tanium fields-- ip dnsname mac 

ACAS--ip dnsname mac

HBSS-ip dnsname mac

So when I use join command, I was not able to include all ips from each respective tools since join only can use as inner/left/outer. Also another problem is the search takes like forever.

Also only ACAS has root search with accelerated capability... 

 My goal is to see  like   

ip                                       mac                                  dnsname       seen in ACAS  seen in Tanium seen in HBSS

123.21.323.422      22:22:22:22:22:22:22     abesdc              Yes                          No                         No  

Any feedback for suggestion will be appreciated.

Thank you

[ITWhisperer]

Would something like this work?

search ACAS
| eval seen_in_ACAS="Yes"
| append [search Tanium]
| eval seen_in_Tanium=if(isnull(seen_in_ACAS),"Yes",null)
| stats values(seen_in_ACAS) as seen_in_ACAS values(seen_in_Tanium) as seen_in_Tanium by ip mac dnsname
| append [search HBSS]
| eval seen_in_HBSS=if(isnull(seen_in_ACAS) AND isnull(seen_in_Tanium),"Yes",null)
| stats values(seen_in_ACAS) as seen_in_ACAS values(seen_in_Tanium) as seen_in_Tanium values(seen_in_HBSS) as seen_in_HBSS by ip mac dnsname
| fillnull value="No"