Based on your clarification:
I have an index=AAA in which I have two fields "field_one" and "field_two".
I have another index=BBB in which I have another two fields "field_three" and "field_four".
If I use the below :
index=AAA field_one="somevalue" | map search="search index=BBB "somestring" field_three=$field_one$ "
in the above scenario, if any of the value from field_one exists in index=BBB,
then "field_three" and "field_four" will show up for that particular matched value.
But I want for all the matched value, I should be able to see all the fields "field_one" , field_two" , "field_three" and "field_four".
I want all the fields from index=AAA and index=BBB should show up for the matched values.
This should do it
(index=AAA field_one="somevalue") OR (index=BBB "somestring") | eval joiner=if(index=AAA,field_one,field_three) | stats values(*) AS * BY joiner | fields - joiner
... View more