How do you compare 2 fields in different indexes to add a third field?

[ppiton]

Hello,

I can't find out how to do a search to compare the same value in 2 fields, and if this is same value, add a third field.

For exemple:
index1 with field1Index1 and field2Index1
index2 with field1Index2

In the search, if field1Index1 = field1Index2 then display field1Index1 and field2Index1
NB: field1Index1 associated to field2Index1in index1

I found different subjects on the forum with eval, if... but not with all that conditions.

Can you help me?

Thank you.

[saurabhkharkar]

Can you try this ?
This will return results only if field1Index1=field1Index2

| makeresults
| eval field1Index1= 4
| eval field2Index1= 7
| eval field1Index2= 4
| eval field1Index1New =case(field1Index1=field1Index2,field1Index1,field1Index2=field1Index1,field2Index1,1=0,0)
| where field1Index1New!=""
| table field2Index1 field1Index1New

[ppiton]

Ok but i don't need to set values 4 or 7.
I need to use values of search.
Thank you.

[saurabhkharkar]

yeah, all you have to use is

index=index1 OR index=index2
| eval field1Index1New =case(field1Index1=field1Index2,field1Index1,field1Index2=field1Index1,field2Index1,1=0,0)
| where field1Index1New!=""
| table field2Index1 field1Index1New