How to return data based on search of one Source and lookup to a second

[El_Franco]

Hopefully this will set the issue out clearly. 

I have two sources, Transaction and Request.

The Transaction holds the transaction id, date and time and user details of a user transaction.

The Request holds the request id, transaction id and an XML string with details of a users search.   

I have a query that searches the Request and returns those searches which contain specific strings. However i need to show the user details on the results  table. 

index="PreProdIndex" source="Request"
"<stringCriterion fieldName=\"Product\" operator=\"equals\" value=\"Soup\"/>"
OR "<stringCriterion fieldName=\"Product\" operator=\"equals\" value=\"Biscuits\"/>"

| table REQUEST_DATE_TIME REQUEST

So I need to add onto the table USER_DETAILS from the Source "Transaction" to the above query based on the common key of the Transaction ID. 

In SQL I would simply put in a join on Transaction.ID=Request.Transaction_ID and all would be good but I have failed to find anything that gives a SPLUNK solution yet. 

[richgalloway]

Splunk has a join command that may do the job, but it's inefficient.  The typical solution is to fetch both sources and then group them together by a common field using the stats command.

index="PreProdIndex" (source="Request"
"<stringCriterion fieldName=\"Product\" operator=\"equals\" value=\"Soup\"/>"
OR "<stringCriterion fieldName=\"Product\" operator=\"equals\" value=\"Biscuits\"/>") OR source="Transaction")
| stats values(*) as * by transaction_id
| table REQUEST_DATE_TIME REQUEST *