How to lookup and match fields across sources?

[krisalexroberts]

Hello,

I have two sources:

1: Device, SiteName, Long, Lat
2: Device, Clients (Number of current clients)

I wish to generate a heat map based on number of users in locations, but cannot figure out how to create a search with one concise table, such as:

Device, SiteName, Clients, Long, Lat

[richgalloway · Accepted solution]

This should get you headed in the right direction.

(index=foo source=one) OR (index=bar source=two) | stats list(SiteName) as SiteName, list(Long) as Long, list(Lat) as Lat, list(Clients) as Clients by Device