There are couple of Solutions like below authors have mentioned if the format of the output is not important : I am putting what i did with your kind of data .
| makeresults
| eval Data1="XY D 1,AB A 3,CD B 2"
| makemv Data1 delim=","
| mvexpand Data1
| eval Field1=mvindex(split(Data1," "),0)
| eval Field2=mvindex(split(Data1," "),1)
| eval Field3=mvindex(split(Data1," "),2)
| fields _time Field1 Field2 Field3
| append
[| makeresults
| eval Data2="ST K 3,GF L 2"
| makemv Data2 delim=","
| mvexpand Data2
| eval Field1=mvindex(split(Data2," "),0)
| eval Field2=mvindex(split(Data2," "),1)
| eval CIL_ID=mvindex(split(Data2," "),2)
| fields _time Field1 Field2 CIL_ID
| rename CIL_ID as Field3 ]
| stats values(Field1) as Field1 values(Field2) as Field2 count by Field3
| nomv Field1
| nomv Field2 | where count>1
I think you are trying to get the common ID between the two searches and trying to join the results. The above should show you the concept. Please let us know which of the solutions work for you.
... View more