How to search field from log1 in to match in log2 and display field in log1 and log2 in table?

[tgmvt03]

Hello Everyone.

I wonder if anyone could help me with a report I'm trying to make.

Below is my sample logs format.

log1 example.

ipfield sessionfield - - timefield urlfield methodfield 

log2 example

datefied midfield sessionfield2 sessionfield3 userfield functionfield ipfield2 rolefield.

what I want to do is search log2 if the sessionfield in log1 exists, then print out a table that has 

userfield from log2, ipfield from log1orlog2, all sessionfield from log1 and log2,   userfield from log2, urlfield and mehtodfield and the counts of methodfield.

I have something like this 

(index=1 log2) OR (index=1 log1)| eval sessionfield=coalesce(sessionfield,sessionfield2,sessionfield3) | stats values(sessionfield) values(ipfield2) by sessiontuser

I got the sessionfield(s) to print but it did not print the sessionfield in log1.

I could not figure out how to print the other fields that I needed 

I don't have much experience in Splunk search so any guidance or help would be excellent.

thank you.

[tgmvt03]

sorry my typo on the sessionuser, it suppose to be userfield in log2.

thank you for the wildcard query it helps me understand how coalesce works more.

[richgalloway]

There is no sessiontuser field in the example query so I'm not surprised it doesn't produce the desired results.  It's close, though.  Try this variation:

(index=1 log2) OR (index=1 log1)
| eval sessionfield=coalesce(sessionfield,sessionfield2,sessionfield3) 
| stats values(*) as * by sessionfield