How to join fields from other index with comparing fields

[ykwon7]

Hello,

Cloud you give me some tips.

Search Query S1
index=S1
| bla bla bla
| stats value(dstIP) value(dstPort) value(srcIP) value(srcUser) by URL

In S1's results, I want to add "sum(Byte)", Byte is in S2.
Also S2's log has dstIP, dstPort and Byte.
From comparing S1_dstIP with S2_dstIP, I want to add "sum(Byte)" on the search result.

[ykwon7]

S1's log ={dstIP, dstPort, srcIP,srcPort, srcUser, URL}
S2's log ={dstIP, dstPort, srcIP,srcPort, srcUser, Bytes}

Result = dstIP, dstPort, srcIP,srcPort, srcUser, sum(Bytes) by URL

So then, I think it needs to be joined by comparing dstIP, dstPort

[to4kawa]

index=S1 OR index=S2
| eval key=dstIP."_".dstPort."_".srcIP."_".srcPort."_".srcUser
| stats values(URL) as URL sum(Byte) as Bytes by key
| rex field=key "(?<dstIP>.*?)_(?<dstPort>.*?)_(?<srcIP>.*?)_(?<srcPort>.*?)_(?<srcUser>.*)"
| table URL Bytes dstIP dstPort srcIP srcUser
| where isnotnull(URL)

see reference: https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Stats