Hi, Basically, I'm trying to correlate 2 datasources with 2 fields. For example, I have datasource1 and datasource2 then I need to be able to return all field1 with corresponding field2. But I also need to validate if field1 with corresponding field2 exists in datasource2 before it is dispalyed or returned. Finally show in a graph which fields exists in both datasources and which fields do not exists. I tried the ff:
sourcetype=* field1=* field2=2
also tried join and sub query approach but no luck
sourcetype=datasource1 | join field1 [sourcetype=datasource2]
Please point me in the right direction. TIA.