sourcetypes comparison for the similar data with varies filed names

[svemurilv]

I had 2 different sourcetypes on each contains the Domain, hostname,ipaddress

sourcer1 having data like.

Domain="ausdc.com", Indic="ipaddress" , host="172.20.53.4"
 Domain="ausdc.com",Indic="hostname", host="applicationhost2"

 Domain="sfodc.com", Indic="ipaddress" , host="172.21.53.4"
 Domain="sfodc.com",Indic="hostname", host="applicationhost4"

 Domain="sfodc.com", Indic="ipaddress" , host="172.21.53.7"
 Domain="sfodc.com",Indic="hostname", host="applicationhost8"

source2 having data like

Domain="ausdc.com", host="applicationhost2" , ipadd="172.20.53.4"
Domain="sfodc.com" , host="applicationhost4",  ipadd="172.20.53.4"
Domain="ausdc.com" , host="applicationhost8",  ipadd="172.21.53.7"

is there any way to compare discriminates between 2 data sourcees. like if the indic=hostname and compare that host in the second sourcertype and match with the domain and ipaddress. if the host domain and ip exist in both places true or other wise false

[poete]

Hello @svemurilv,

is it a typo or do you have both Indic, with capital i and indic in the data?

Assuming this is the case, you can try something like this:

index=<firstIndex> Indic="hostname"|join domain host [search index=<secondIndex>]

This will associate, if existing, the ipadd of the second source to the result of the first search, with matching domain and host.

[svemurilv]

you are right using the join or append we could merge the data where is the comparison between the sourcetype1 Indic="ipaddress" with sourcetype2 ipadd and domain? in my recently added example there is a difference between the 2 source records in applicationhost8 domain is not going to be match there i want to find those unmatched records

[poete]

Helpful link:
http://docs.splunk.com/Documentation/Splunk/7.1.1/SearchReference/Join