Answer by warren for Using if to get splunk rseslut from another index

Without sample data, this is only a guess, but this join form should work:

index=ndxA sourcetype=srctpA
| timechart span=10m MAX(count) as result
| eval temp=if(result > 150 ,1,0) 
| streamstats sum(temp) AS tempsum window=2 
| eval Alert=if(tempsum == 2 , 1,0)
| join Alert
    [| index=ndxB sourcetype=srctpB process_name=*
    | stats count by process_name
    | eval Alert=if(match(process_name,"this_is_a_1"),1,0)
    | fields - count ]

from User warren – Stack Overflow https://stackoverflow.com/questions/74883613/using-if-to-get-splunk-rseslut-from-another-index/74888765#74888765
via IFTTT