Correlate fields from two sources

[rbw78]

Hello,

I would like to correalte events from 2 sources by using a field where there's a hostanme.
If i find a match between the hostanmes in event_source_1 and event_source_2 then in output i would have all the hosts with the total of events for these 2 sources.

The search should looks something like that.

source=event_source_1 or source=event_source_1 | if 'hostanme_source1' == 'hostanme_source2' then display hostname, do it until end of logs

I'd already look at the function contingency, correlate and associate it seems to work for only one kind of log source.

Does someone know how to do that ?

Thanks.

[ziegfried]

Find all hostnames that occur in the specified fields in both sources:

source=event_source_1 OR source=event_source_2 | eval common_host=coalesce(hostanme_source1, hostanme_source2) | stats dc(source) as occur by common_host | where occur>1 | fields - occur