Hello guys, I have the VPN log and network log. - In VPN log's it's possible to show IP and USERNAME  - In Network log it's possible to show what's site the IP access.  I need to comparare 2 fields ( IP VPN  [src_ip] , IP Network [SRC])  if the field is the same i will add the user. I Tried this:       index=security host=homolog (sourcetype=vpn_log OR sourcetype=network_log) | where src_ip=SRC | eval username_acess=user | table username_acess,SRC,dst       But doesnt work. Another way is:       | eval field1=SRC,field2=src_ip | eval results1=if(field1=field2,"Yes","No") | eval results2=if(match(field1,field2),"Yes","No") | where match(field1,field2)       I think the error is because the sourcetype is different. Could you help me ?          ... View more