Assuming there is only one event for each soar_uuid in either of the two searches, i.e. it is unique in its search but possibly duplicated in the other search, you could do comething like this | localop | rest ....
```first search key field```
|eval soar_uuid= id+"_RecordedFuture"
|append [search index=rf-alerts soar_uuid]
| eventstats count by soar_uuid
| table soar_uuid,triggered,rule.name,title,classification,url,count count would then be 2 if it is duplicated in the appended search
... View more