How to relate two different events in two different indexes based on related fields?

[svercelli]

So what I have are two different types of events. However, both have an key field that connect the two events together. (One event type has a keynum field that has its unique ID number, and the other has a relatedkeynum field that connects these events to the first. Is there a way to run a search on the first event types and bring up only events from the second type based on their matching keynum's?

[szabados · Accepted solution]

index=otherindex [search index= | rename relatedkeynum as keynum | return $keynum ]

[pradeepkumarg]

What you are looking for is a subsearch http://docs.splunk.com/Documentation/Splunk/6.4.1/SearchTutorial/Useasubsearch