title: Splunk compare two rex queries from different source
body: <p>I have two queries...</p>
  
  <p><strong>(1)</strong> submit log query:</p>
  
  <pre><code>index=xxx_prod host="foo.org" 5032 submit | rex "id=PO:(?&lt;PO&gt;\d*)" | dedup PO | table PO _time
  </code></pre>
  
  <p><strong>(2)</strong> saved log query:</p>
  
  <pre><code>index=xxx_prod host="bar.org" | rex "savePO.*POId=(?&lt;PO&gt;\d*).*\"responseCode\":200" | dedup PO | table PO _time
  </code></pre>
  
  <p>I want to compare both <code>PO</code> and <code>timestamp</code> (from _time field) results from different services one is a submit event, another one is a save event. and I want to show it as the following table</p>
  
  <pre><code>   PO    | submit_date             | save_date               | elapse_time_min | isSave   
   1000001 | 2020-01-18 02:09:49.022 | 2020-01-18 02:51:51q289 | 41              | true
   1000002 | 2020-01-18 03:18:25.780 | 2020-01-18 03:59:08.695 | 49              | true
   1000003 | 2020-01-18 03:18:25.780 |                         |                 | false
  </code></pre>