How can I merge two splunk queries together?

[Taibat02230232]

I have two Splunk queries 1 and 2 below, and both have one common email , i want the searched emails generated from the result which are email variable to be able to send an alert notification base on the search result generated email.

I need the common value to have the field with matching values in both queries which is the email , then be able to send an email alert notification

Query-1

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" |fields *
| spath "requestParameters.roleArn" |search "*super*admin*"
| rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)"
| search Email=*
| table Email,"recipientAccountId"
| dedup Email, "recipientAccountId"

Query-2

index="okta" displayMessage="Authenticate user with AD agent"
| rename target{}.alternateId as email
| eval my_ponies=mvindex(email, -3, -2)
| eval Email=mvindex(email, 0)
| eval email=mvindex(email, 1)
| table Email email

Here are the two of them, please any input will help

[gcusello]

Hi @Taibat02230232,

if you're sure that one of the searches has less than 50,000 results, you can use append:

index="aws-cloudtrail" eventName="AssumeRoleWithSAML" 
| spath "requestParameters.roleArn" 
| search "*super*admin*"
| rex field=responseElements.subject "(?<Email>[a-zA-Z0-9]{1,8}@digitlogs.com$)"
| search Email=*
| table Email,"recipientAccountId"
| dedup Email, "recipientAccountId"
| append search
   index="okta" displayMessage="Authenticate user with AD agent"
   | rename target{}.alternateId as email
   | eval my_ponies=mvindex(email, -3, -2)
   | eval Email=mvindex(email, 0)
   | eval email=mvindex(email, 1)
   | table Email email
   ]
| stats 
   values(recipientAccountId) AS recipientAccountId 
   values(email) AS email 
   BY Email

otherwise you have to use a more complex search.

Ciao.

Giuseppe