How do i extract a value from one search, use it in a second search, and then output fields from both searches

[ezmo1982]

Hi 

I need to search one index, extract a value from a field from that search, then use that value when searching a different index. I then need to join values from both searches into my output. Im guessing i need to use a subsearch or append of some kind?

First search is index=cisco_fw | stats values(action), values(user). 

Second search is index=web_proxy | stats values(url). This index also contains a field named user. I want to use the value of user from the first search and search the user field in the second search with that value. In other words,  the user field value from both search needs to match. I then need to combine the output i.e values(action) values(url) and values(user) to display all three values on one line.

Thanks. 

[ITWhisperer · Accepted solution]

Have you tried:

index=cisco_fw OR index=web_proxy | stats values(action), values(url) by user