Oh, I should have mentioned there ARE a few tools to help with this process a bit - probably the most interesting is the Splunk command fieldsummary which will give information about fields and using the Patterns tab (which uses cluster behind the scenes, if I remember rightly).
If you run that against each index/sourcetype, then compare the results, you might find some commonalities. Obviously you'll have to use some sense in deciding if it's really related and not just accidentally related, but it's at least pretty good at telling you when two fields aren't similar, in any case.
For instance, if I ran
index="fw"
| fieldsummary
| fields - values
It would give me a list of the types of things found in my home firewall logs. I do a | fields - values only because for my purposes that's noise in these logs - you can try it both with that or without that and see which you find more useful. Anyway, from that list I can see that, for instance, SPT and DPT are both numbers, both range between 1 and about 65000, both appear in practically all records, and both have a distinct_count of 500 (or really close to each other, anyway). So, it's possible these two may cover the same sort of domain (Which they do, it's destination and source port for network traffic).
For the Patterns tab, it's less useful for comparing data, but not always useless - a couple of times it's found similar events in two data sources (though admittedly those data sources are usually very similar ones anyway). So you'd craft a search like index=A OR index=B and adjust your time frame to something where there's a few thousand events. Then click on the tab labeled 'Patterns' and give it a bit of time to load, then take a look at what it's telling you.
So, hopefully that helps a little bit, even though I know finding how data is related to one another is a tricky thing that requires a lot of thinking. For what it's worth, I don't really know of any system that finds proper interrelationships like this - even the best are just guessing based on information like what you might get from fieldsummary and require a lot of thinking and more study to determine if that's actually the case.
... View more