i have have two sourcetypes say sourcetype1 and sourcetype2 these two source type are in the same index
sourcetype1 has the fields CID and CN
sourcetype2 has the fields CID and Application
if in the two source types the CID matches i want to print the result CN,application
please help me
Try this
index=* (sourcetype=st1 OR sourcetype=st2) | stats dc(sourcetype) as count values(CN) as CN values(application) as application by CID | where count=2
Like this:
index=MyIndex (sourctype=sourcetype1 OR sourcetype=sourcetype2)
| stats dc(sourcetype) AS numSourcetypes values(*) AS * by CID
| search numSourcetypes=2
| table CN Application
Try this
index=* (sourcetype=st1 OR sourcetype=st2) | stats dc(sourcetype) as count values(CN) as CN values(application) as application by CID | where count=2