Bellow mentioned table is an example which having same index and sourcetype, but it have a different source.
I need to search a field from 1st file and the result should be a combination of fields from file 1 and 2.
File 1
| T1_Fld 1 | T1_Fld 2 | Domain | T1_Fld 4 | T1_Fld 5 |
| AAA | xxx | google.com | yy1 | bbb |
| AAB | xxx | Facebook.com | yy2 | bbb |
| AAB | xxx | Gmail.com | yy3 | bbb |
| AAD | xxx | Yahoo.com | yy4 | bbb |
| AAE | xxx | xxx.com | yy5 | bbb |
File 2
| Domain | IP |
| google.com | 1.1.1.1 |
| Facebook.com | 2.2.2.2 |
| Gmail.com | 3.3.3.3 |
| Yahoo.com | 4.4.4.4 |
| xxx.com | 5.5.5.5 |
consider i am running a search where T1_Fld 1=AAB then the result table form should be like below.
Output
| T1_Fld 1 | Domain | IP | T1_Fld 4 |
| AAB | Facebook.com | 2.2.2.2 | yy2 |
| AAB | Gmail.com | 3.3.3.3 | yy3 |
Use stats to combine them
index=data_set1 OR index=data_set2
| stats values(*) as * by DomainHere uses values(*) as * to collect all fields from both data sources against their common field Domain.
You can filter then what you do or don't want, e.g. after the above, do
| where T1_Fld 1="AAB"