Sorry I should be more specific. By "JOIN" I mean using the actual join command:
source=foo | eval matchField=fieldA
| join matchField [ search
source=bar | eval matchField=fieldC ]
| append [ search
source=foo | eval matchField=fieldB
| join matchField [ search
source=bar | eval matchField=fieldC]
So the 1st source has both a fieldA and fieldB that could potentially match with a fieldC in the 2nd source in the join statement. While the above search works, I'm trying to figure out a better, cleaner way to join, instead of running all of these sub searches.
... View more