Display only values found in two searches

[atl215]

index=rap sourcetype="joyner lucas"
| dedup albums| table albums
|append [search index=country sourcetype="lil Nas"
|dedup songs| table songs]

[atl215]

From this answer, how would I chart the matches of this search?

 (index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
 | eval check_match = coalesce(albums,songs)
 | stats count by check_match 
 | where count > 1

[adonio · Accepted solution]

try this:

(index=rap sourcetype="joyner lucas" albums=*) OR (index=country sourcetype="lil Nas" songs=*)
| eval check_match = coalesce(albums,songs)
| stats count by check_match 
| where count > 1

here is an example to try anywhere:

| makeresults count=1
| eval data = "x,y,z,123;;;x,y,z,124;;;x,y,z,125;;;x,y,z,126;;;a,b,c,123;;;a,b,c,134;;;a,b,c,125;;;a,b,c,136"
| makemv delim=";;;" data 
| mvexpand data
| rex field=data "(?<idx>[^\,]+)\,(?<st>[^\,]+)\,(?<letter>[^\,]+)\,(?<number>.+)"
| eval album = if(idx=="x",number,null())
| eval song = if(idx="a",number,null())
| table idx st album song
| rename COMMENT as "the above generates data below is the solution" 
| search (idx=x st=y album=*) OR (idx=a st=b song=*)
| eval check_match = coalesce(album,song)
| stats count by check_match
| where count > 1

hope it helps

[atl215]

I would like to list the values that match