Your final solution is not only scales to more situations, but doesn't force it to be a 2 sourcetype situation. Thank you. This mostly satisfies everything (although i'd be great to know the sourcetype with the field in the lists, but that is probably impractical). TLDR, here was @yuanliu solution that is better than mine. search_here_that_has_two_or_more_sourcetypes | fields - sourcetype | stats values(*) as * | transpose | rename "row 1" as ip | stats values(column) as fieldname by ip | where mvcount(fieldname) > 1   ... View more

This ended up getting the job done, but it still doesn't reference the sourcetype automagically. I'm aware I could use header_name=sourcetype to change row 1 and row 2, but ended up going with this for more general ease for someone following. index=fruit sourcetype IN ("apple","orange") | transpose | eval allvalues=mvappend('row 1', 'row 2') | stats dc(column) AS dc_column values(column) AS columns BY allvalues | where dc_column>1 This flips the column names into a value, and then if 2 or more columns match the same value, it will suggest that they might be duplicates and list the duplicate fields. ... View more

Thanks for the ideas so far. I will clarify more. Lets say I have the following data that I am certain represents the same communication (orange is a device that sees traffic and apple is another device, I have confirmed that it is the identical communication, but they log differently).  destip vlan dip sip sourceip sourcetype 5.6.7.8       12.23.34.45 orange 5.22.66.11       45.56.67.89 orange   111 5.6.7.8 12.23.34.45   apple   111 5.22.66.11 45.56.67.89   apple   I can look at this and say "oh, they are the same traffic but it looks like orange and apple use a different taxonomy! I will combine sourceip and sip into src_ip. I will combine destip and dip into dest_ip!". I want to do this programatically without having to manually identify the common fields. Using JSON or something, I could transpose the values and the fields and say "show me the listing of the fields BY the values. Programmatically my result would look something akin to the following with a transpose; 45.56.67.89 12.23.34.45 5.22.66.11 5.6.7.8 111 sourceip sip sourceip sip destip dip destip dip vlan orange apple orange apple  orange apple orange apple apple   Admittedly that wouldn't be the prettiest version of the result, but it would get the job done. Any version of that result (one that says "here are redundant field names from semi-redundant sources) that lists the fields and their sourcetypes) would work. ... View more

This will output only things where the url looks like an ip address. sourcetype=fakename | where match(url, "^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$") ... View more