https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227835#M188362 <P>You can use a <CODE>case</CODE> statement to do this </P> <P><CODE>... | eval Your_field=case(sourcetype == sourcetype1, "true", sourcetype == sourcetype2, "true" , 1=1, "false")</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions</A></P> Fri, 12 Aug 2016 15:01:07 GMT skoelpin 2016-08-12T15:01:07Z https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227834#M188361 <P>Hello, I am looking for a search query that can also be used as a dashboard. <BR /> The query has to search two different sourcetypes , look for data (eventtype,file...etc.) and if the information is missing in one sourcetype and found in another, then it will provided that data for that sourcetype. </P> Fri, 12 Aug 2016 14:22:34 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227834#M188361 bluemarvel 2016-08-12T14:22:34Z https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227835#M188362 <P>You can use a <CODE>case</CODE> statement to do this </P> <P><CODE>... | eval Your_field=case(sourcetype == sourcetype1, "true", sourcetype == sourcetype2, "true" , 1=1, "false")</CODE></P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions">http://docs.splunk.com/Documentation/Splunk/6.4.2/SearchReference/CommonEvalFunctions</A></P> Fri, 12 Aug 2016 15:01:07 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227835#M188362 skoelpin 2016-08-12T15:01:07Z https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227836#M188363 <P>Could you be more specific in your requirement, supported with sample queries/events and expected output?</P> Fri, 12 Aug 2016 16:32:53 GMT https://community.splunk.com/t5/Splunk-Search/Subsearch-using-boolean-logic/m-p/227836#M188363 somesoni2 2016-08-12T16:32:53Z