compare two searches

[zuzgon2]

Hey,
I want to compare the results of the first search to the second. Like loop through the second one with the first ones results

Something like this,
Index=index1| eval val1=substr(value, 0,1) [search index=index2| eval val2=substr(value2, 2,1) | eval match=if(val1==val2, 1,0)]

Thanks!

[somesoni2]

Try this

index=index1| eval val1=substr(value, 0,1) | eval joinfield=1 | join max=0 joinfield [search index=index2| eval val2=substr(value2, 2,1) | eval joinfield=1] | eval match=if(val1==val2, 1,0)