How to merge two tables to get result in one table

[avi7326]

How to get a single table from this query having all the correlationId together in one table

[ITWhisperer]

Your join has already created a single table. However, you might want to consider including both sourcetypes and filters in the same initial search, then collate the events with a stats command.

[avi7326]

What else I can do to get the correlationId in one table as this query is comparing and giving the common results.

(sourcetype=bmw-crm-wh-sl-sfdc-subscribe-pe-int-api ("Received platform event for CUSTOMER"))

| table properties.correlationId

| join left=L right=R type=inner where L.properties.correlationId=R.properties.correlationId [search sourcetype=bmw-pl-customer-int-api ("recipient : *.ESOCRM") | table properties.correlationId]

And can I again you join in this query.

[ITWhisperer]

(sourcetype=bmw-crm-wh-sl-sfdc-subscribe-pe-int-api ("Received platform event for CUSTOMER")) OR (sourcetype=bmw-pl-customer-int-api ("recipient : *.ESOCRM")) | stats values by properties.correlationId