Not sure how to accomplish this....
First search:
index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | stats count by client_mac
If results are returned from first search, take the results "client_mac" and perform this search
sourcetype="nac" client_mac
display results
does this look correct?
sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | return 100 client_mac] | stats count by client_mac, Users_Name, Company, _time
I'd do
sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| fields client_mac]
if you want to search for sourcetype=nac client_mac=XXX OR client_mac=YYY
or
sourcetype="nac" [search index="airtight" message=quarantined eventtype="airtight_intrusion" NOT Agere | dedup client_mac| format "" "" "" "" "OR" ""]
if you want to search sourcetype="nac" XXX OR YYY