https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334026#M164438 <P>@hkchew</P> <P>try this <BR /> sourcetype=sourcetypeA | fields ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum | join GroupID [ search sourcetype=sourcetypeB | fields PhoneNum, VAS1, VAS2 ] | search PhoneNum=* | table PhoneNum, GroupID, DeviceUsed, DeviceSerialNum</P> <P>i hope this helps</P> Mon, 11 Dec 2017 21:02:17 GMT sbbadri 2017-12-11T21:02:17Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334025#M164437 <P>I have 2 sourcetypes:<BR /> Eg. sourcetypeA has fields such as ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum<BR /> sourcetypeB has fields such as Name, GroupID, PhoneNum, VAS1, VAS2</P> <P>When I search using PhoneNum ONLY, the result needs to display PhoneNum, GroupID, DeviceUsed, DeviceSerialNum</P> Mon, 11 Dec 2017 19:09:44 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334025#M164437 hkchew 2017-12-11T19:09:44Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334026#M164438 <P>@hkchew</P> <P>try this <BR /> sourcetype=sourcetypeA | fields ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum | join GroupID [ search sourcetype=sourcetypeB | fields PhoneNum, VAS1, VAS2 ] | search PhoneNum=* | table PhoneNum, GroupID, DeviceUsed, DeviceSerialNum</P> <P>i hope this helps</P> Mon, 11 Dec 2017 21:02:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334026#M164438 sbbadri 2017-12-11T21:02:17Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334027#M164439 <P>Try like this</P> <PRE><CODE>(sourcetype=sourcetypeA) OR (sourcetype=sourcetypeB PhoneNum="YourSearchedPhoneNumHere") | fields GroupID, DeviceUsed, DeviceSerialNum PhoneNum | stats values(PhoneNum) as PhoneNum values(DeviceUsed) as DeviceUsed values(DeviceSerialNum) as DeviceSerialNum by GroupID | where isnotnull(PhoneNum) </CODE></PRE> Mon, 11 Dec 2017 22:04:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334027#M164439 somesoni2 2017-12-11T22:04:14Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334028#M164440 <P>Thank you, guys but none of the above works.<BR /> The field name of GroupID of sourcetypeA is different from sourcetypeB although both GroupID are found on field#2 in both sourcetype.</P> Tue, 12 Dec 2017 09:51:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334028#M164440 hkchew 2017-12-12T09:51:04Z https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334029#M164441 <P>Thank you guys but none of the above works.<BR /> The field name of the groupid is different in both sourcetype although groupdid is found in the field#2 of both sourcetype</P> Tue, 12 Dec 2017 09:54:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-perform-search-only-using-PhoneNum/m-p/334029#M164441 hkchew 2017-12-12T09:54:24Z