Join 2 searches which has common fields as 2 different field name with same value

[Dharani]

Hi, 

My main goal is to find user id.

Index=A sourcetype=signlogs outcome=failure

The above search has a field name called processId but it doesn't have the userId which I needed.

Index=A sourcetype=accesslogs -->This search has a SignatureProcessId( which is same as processId in the search1) and also it has userId.

So I need to join these 2 query with common field as processId/SignatureProcessId

I tried the below query but it results 0 events:

Index=A sourcetype=signlogs outcome=failure 

| dedup processId | rename processId as SignatureProcessId | join type=inner SignatureProcessId [Index=A sourcetype=accesslogs | dedup SignatureProcessId ] 

| Table _time, SignatureProcessId, userId

Someone please help with fixing this query.

[ITWhisperer]

Try something like this

index=A (sourcetype=signlogs outcome=failure) OR (sourcetype=accesslogs)
| eval processId=coalesce(processId, SignatureProcessId)
| eventstats values(userId) as userId by processId

[Dharani]

Hi, 

It's not working.

It results all the logs for sourcetype=accesslogs.

But our aim is to join the 2 sourcetypes to get userId for failure logs

[ITWhisperer]

Please share some anonymised sample events in a code block for both source types demonstrating the common fields you want to use to correlate the events by.