How to combine index queries from different field names?

[cclva]

I have two indexes:

IndexA has a `thisId` field.

IndexB has fields `otherId` and `name`.

I want to write a query which returns a table of all `thisIds` with a matching `name`. The challenge has been writing the query such that it doesn't return all the `otherId` fields as well.

My current query is:

(index="indexA") OR (index="indexB") | eval id=coalesce(thisId, otherId) | stats values(name) as name by id

However, this is returning all the ids in indexB as well.

Thank you

[PickleRick]

Sorry, I fail to understand. If IndexA has 'thisId', how does it "match" the 'name' from IndexB?

[cclva]

The values of `thisId` match `otherId`. `thisId` is a subset of `otherId`

Sorry, I've been trying to include an example, but the forum won't let me post the html.

[PickleRick · Accepted solution]

Yep, there is a problem with the editor. Luckily it's about to be resolved soon.

So you want only the values of 'name' from IndexB, for which there is an entry in IndexA with the corresponding id field?

You were relatively close

index=IndexA OR index=IndexB
| eval commonId=coalesce(thisId,otherId)
| stats dc(index) as count values(name) by commonId
| where count=2
| fields - count