How to find items from one index across other index's.

[SMM10]

We have specific ID's that track how request process through the system. What I want to do search for all these ID's in one index and then join all other index's to see how these funnel down. So essentially track how a request tracks through our system, and then get all the service requests associated. I was thinking something like: 

index=foo
|fields service, ID
| join ID [index=*]
| stats service

[bowesmana]

At the most basic, if you go for join, then your existing SPL should look something like this

index=foo
| stats count by service ID 
[ 
  | join ID [index!=foo]
  | stats values(service) by ID
]

but join is never a great option - it is slow and has limitations in the number of results that can be handled by the subsearch - and the solution is not to increase the limit.

As @PickleRick says, it is better to run stats across the data set you want to search and then perform stats and test operations on the results.

The question is: What do you want to do having found the correlated services - is there any other data you want to use following the initial search, if so that will dictate how your search will look.

[PickleRick]

If all your events in question had the ID field you could do something like (rough idea)

index=* ID=* | stats values(_raw) by ID

But that would mean doing stats  across all your indexes which is not very effective to say the least.

But your join would be even worse 😉