I am running 2 different Index and have to compare each value in field 1 from 1st index with the values in field2 from index 2 . & also regex is used for other field value. The display result should show a match or a Non Match against each value.        Given Data: (index=cmi cef_vendor="Imperva Inc." cef_product="WAF" dvc="10.124.1.202" act="None" cs2="*" deviceSeverity=High) OR (index=case_management DeviceProduct=WAF fname IN ("*CMI - WAF*")) | rex field=fname "(-)(?(\s)(PROD|SFR)+(\s))(-)(?(\s)[\w]+(\s)[\w]+(\s))(?(\d)+(\s))(-)" | eval m=coalesce(cn1,alert) | stats values(cn1) as cn1 values(alert) as alert by m | table cn1 alert m   Results should be something like this table: cn1                  alert             m 453626     453626      Match 453624     453626     No Match @elrich11  ... View more

I am using search query from indexes using join operator and get result as below , Search Query = index=case_management AND cef_name="Case inserted" | where fname LIKE "%%CMI - IPS%%" | dedup fileId | join fname [ search index=case_management AND cef_name="Case updated" ] | rex field=fname "CMI - IPS - \((?<customer_id>[\d]+)\) - CMI (?<Env>[^\s]+) - " | where Env ="Prod" | timechart span=1mon count by flexString2 fixedrange=false cont=false | where _time>=relative_time(now(),"-3mon@mon") AND _time<relative_time(now(),"-0mon@mon")   Result is= _time       Closed Follow-Up Queued 2020-09   113             4                   1 2020-10   26                0                   0 i want to get the same result by writing a query using data model.  @elrich11  ... View more