I would like to correalte events from 2 sources by using a field where there's a hostanme.
If i find a match between the hostanmes in event_source_1 and event_source_2 then in output i would have all the hosts with the total of events for these 2 sources.
The search should looks something like that.
source=eventsource1 or source=eventsource1 | if 'hostanmesource1' == 'hostanmesource2' then display hostname, do it until end of logs
I'd already look at the function contingency, correlate and associate it seems to work for only one kind of log source.