return search with common fields

[simonattardGO]

I need to run two sub searches. Each of these sub-searches will return a set of fields, one of them is called transactionNumber.
Then I want to the search to return only those results from the two sub-searches which have an equal transactionNumber.

How can I do this?

[Ayn · Accepted solution]

Use set (http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Set):

| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*]

If you want not just the transactionNumbers but also the actual events, you could feed this into a subsearch:

(search1) OR (search2) [| set intersect [search search1 | fields transactionNumber | fields - _*] [search search2 | fields transactionNumber | fields - _*] | fields transactionNumber ]