search 2 logfiles from same source, but different fields.

[dbrooks_CIR]

I have an index which contains data from many logfiles. I want to search for specific data in log1 and display  with field count from log2. Log1 has the url data (sites, page loads, etc) and log2 has the username,  with a common field X_Forwarded_For.  My search is below. I'm wanting to show a count based on username in log2  of all url clicks in log1. So far I have this:

index = iis-prod host = hostname source="logfile1" cs_uri_stem="*.aspx" NOT(/_layouts/*.aspx) NOT(/_forms/*.aspx) NOT(/_login/*.aspx) NOT X_Forwarded_For = 10.* | stats count by X_Forwarded_For |sort by count desc

Instead of displaying X_Forwarded_For from logfile1, I want to display the count with username from Logfile2. 

I'm sure i'm making this more complicated than it needs to be, I just can't get it cleared up. 

[renjith_nair]

Please provide some sample events if possible.

In general, you should be able to combine them as

index = iis-prod host = hostname (source="logfile1" cs_uri_stem="*.aspx" NOT(/_layouts/*.aspx) NOT(/_forms/*.aspx) NOT(/_login/*.aspx) NOT X_Forwarded_For = 10.*)
   OR (source="logfile2" <conditions for logfile2)
 | stats count(username) by X_Forwarded_For |sort by count desc