Using the Output from a Search in One Index to Search in a Second Index

[JoeHubner]

I am looking to search in one Index for a specific field name and then use a second field from that Index to search a second Index for that value.  For example

IndexA has field names Project and IRNumber / IndexB has a field named InternalRequest

IRNumber in Index A and InternalRequest in IndexB are the same values

I would like to search IndexA by Project and then use the associated IRNumber from IndexA to search IndexB for the InternalRequest with the same value and then table various values from IndexB associated with that InternalRequest value.  Is there some way to use a sub-search to do this?

[JoeHubner · Accepted solution]

Worked like a charm.  Thanks for the assistance.

[ITWhisperer]

You can do this with subsearches either by adding the subsearch to the main search, or by using a join, or possibly using stats

For example:

index=B [| search index=A project=X | dedup IRNumber | rename IRNumber as InternalRequest | fields InternalRequest]