How to join 2 event ID in same index (wineventlog)?

[10061987]

Hi all,

I searched my issue on community. There are lots of threads but i couldn't find my issue. As i know i can not see 2 event ID's fields (both of them) in same search because fields are different. I want to see 2 different event ID's fields in same search.

My issue is bit complicated. For this reason i will explain with basic fields and i will change later.

First search:
index=wineventlog EventID=1 process_name=chrome.exe
| stats count by Image process_name process_path CommandLine

Second search:

index=wineventlog EventID=3 DestinationHostname=google.com
| stats count by Image SourceIP DestinationIP DestinationHostname

I want join these 2 searches in same search and i want to see 2 different event ID' s fields in same search. I found join command but i couldn't figure out how to use that.

Any help would be appreciated!

[PickleRick]

More words please. You showed two summarizing searches which do not seem to share any fields so it's unclear how you would like to join them. Especially that you wrote about matching events.