Query question between 2 indexes

[christay]

Hi Guys,

Can i check how can i craft the query given the following condition.

I have 2 indexes IndexA and IndexB with the following filed in each index.

Example as follows :

IndexA

Field contains :

srcIP = 10.10.10.10
cat = malicious IP 100%

IndexB

Field contains  :

TrueClientIP = 10.10.10.10

The objective of my query is to compare "TrueClientIP" under Index B against "srcIP" under IndexA and the condition that if the "cat" field under IndexA is tag under malicious IP it will return me the count .

How can i craft the above query ?

Thanks for the help.

[to4kawa]

index=IndexA OR index=IndexB | eval ip=coalesce(srcIP,TrueClientIP) | rex field=cat "(?<malicious>malicious)" | stats count(malicious) by ip