How to join or search fields from two different indexes with a common field

[vnguyen46]

Hi,
I have two indexes basically like this:
indexA has field1, field2, field3
indexB has field4, field5, field6
field1=field4 (both are username)
I need a table showing:
field1, field2, field5, field6

In SQL, I can use join query, but I don't know how in SPL. Thank you for your help.

[vnguyen46]

Thanks for reply.

Actually, I learned from other post and used this:
indexA sourcetype...| rename field1 AS field | table field1, field2
| join field
[search indexB sourcetype...| rename field4 AS field | table field5, field6]

It works well.
Thanks again.

[iamsplunker31 · Accepted solution]

You can try something like this

index=indexA OR indexB |table field1,field2,field5,field6