How do I match events from two different sources based on a common field found in both?

[jameskerivan]

Hi,

I have 2 fields resp_time and response_time in two different sources. Lets call it source1 and source2. In both of these sources, there is a field, let's call it artifact, that I want to use to match up these response times in a table. I have looked around, but nothing is matching up for me. I was wondering the best approach for this. I was thinking using a subsearch inside my main search to find the artifact in source1 and then use that value to find the event in source2 and match the response times. Is there an easier way?

[somesoni2]

Try something like this

(index=A source=source1) OR (index=B source=source2) | eval response_time=coalesce(response_time, resp_time) | stats values(response_time) over artifact by source

A column need might be required to rename source to something more user friendly name.