Index=windows event_id=XXX user IN (account1, account2, account3) Index=mfa service=ntlm AND loger IN (account1, account2, account3)     Index=mfa contains fields like :  service logger hostsrc app  IP etc.. Index=windows contains fields like:  eventid address user DC name etc.. So far my search was looking only on the index=windows logger and user will probably have the same value accross indexes IP and address will probably have the same value accross indexes I want to compare if values of those fields match, if yes.. take hostsrc field with corresponding values.  If there is no event that contains those two values, take hostsrc from lookuptable using IP field on index=windows (dont bother about mfa index) index=mfa which contains hostsrc that I want to add in my table.  I hope this makes it more clear ... View more

so far..  (index=1 sourcetype=type1 E=condition) OR (index=2 Q=condition) | fields A, B1, B2 C1, C2 D, E, Q | eval B=coalesce(B1, B2) | rename A as D | stats values(*) as * by B | table A B C  It returns common value of A on comparision of B1 and B2.  ... View more