Join 2 fields with the same value in the same search.

[LeandroKopke]

Hi.
I need help to be able to unify 2 fields that have the same value, however, in separate searches.
Here is an example:

Search 1:
source=* sourcetype=fortigate user=* action=tunnel-up reason="tunnel established"| table _time user group action remip reason tunnelip

Search 2:
source=* sourcetype=fortigate dstport=6443 action=close |table srcip, srcintf

The "srcip" and "remip" fields have the same values. I need both searches together, to be able to use the user field of the first search in the second search.

[woodcock]

This does not make sense. Please explain what fields from what search are to be used to program details in what other search OR explain how data from both searches need to be merged together.

[richgalloway]

If search 1 returns 10,000 or fewer results, try a subsearch. Don't forget to specify index(es) in the searches.

source=* sourcetype=fortigate dstport=6443 action=close 
  [ source= sourcetype=fortigate user=* action=tunnel-up reason="tunnel established" | fields user remip | rename remip as srcip | format ]
|table srcip, srcintf

[LeandroKopke]

hi richgalloway, thanks for you reply.
I did the execution of the command only, it doesn't return any results.
I've tried using append and join, but to no avail.

[richgalloway]

Keep in mind my answer is mostly a copy-and-paste of your example queries so any errors there are errors in mine as well.
Try running the subsearch (the part inside [] by itself. Once that is working correctly, add it to the main search.

[LeandroKopke]

Separate, both queries return results.

[richgalloway]

And when you paste the results of the subsearch onto the end of the main search, what do you get?