how to compare values from two different searches and return the results if the values are equal

[manojnelakurthi]

I have 2 searches
Search1:
index=i_temp source=source1
Results:
xCoord=1155276.2781774567 yCoord=1885220.7999824171
xCoord=1144751.2989115883 yCoord=1919044.2279770568

Search2:
index=i_production source=feed
Results:
xCoord=1155276.2781774567 yCoord=1885220.799982417

I want to compare both the search results and return the results if the string xCoord=1155276.2781774567 yCoord=1885220.7999824171 is same in both the searches. In reality the results for bot the searches are larger in number.

Thanks

[DalJeanis]

You can do something like this...

 (index=i_temp source=*source1*)  OR (index=i_production source=*feed* )
 | eval Field1=case(index=i_production,Field1)
 | eval TempTime=case(index=i_temp,_time)
 | eval ProdTime=case(index=i_production,_time)
 | fields xCoord yCoord ProdTime TempTime ...any other fields we want to keep...
 | stats values(*) as * by xCoord yCoord 

If you want a field with a particular name from one index, but not from the other, then you do something like the eval Field1 line. If you need both and you need to know which is which, then use something like the eval TempTime/prodTime lines.

[somesoni2]

Try this (gives list of xCoord and yCoord which are common in both indexes/sources)

(index=i_temp source=*source1*)  OR (index=i_production source=*feed* )
| stats dc(index) as indexes by xCoord yCoord 
| where indexes=2

[manojnelakurthi]

Thanks a lot, I am getting the list, but is there any way to get the full logs because i want to check the hostname on each of the search result to check how many requests are hitting each server for the matched xCoord and yCoord as the application is deployed on 3 servers.