Combining different sourcetypes with no common field ( except _time)

[ISP8055]

Hi, I have one sourcetypeA which has following fields

Cluster1	UsageA
A	10
B	15

and so on

then I have one sourcetypeB which has fields:

Cluster 2	Usage B
C	5
D	20

I want to make a Splunk syntax so that I combine both sourcetypes to see top 3 usage in total among all clusters.
so like this:

Cluster	Usage
D	20
B	15
A	10

So, neither Cluster 2, cluster 1 nor usage A  and Usage B are common fields.
Is this possible to do?

[kamlesh_vaghela]

@ISP8055 

Can you please try this?

index=your_index (sourcetype="sourcetypeA" OR sourcetype="sourcetypeB")
| eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2)
| eval Usage=if(isnotnull(UsageA),UsageA,UsageB)
| fields Cluster Usage
| sort - Usage | head 3

My Sample Search :

| makeresults | eval _raw="Cluster1	UsageA
A	10
B	15" | multikv forceheader=1 | append [
| makeresults | eval _raw="Cluster2	UsageB
C	5
D	20" | multikv forceheader=1 ]
| eval Cluster=if(isnotnull(Cluster1),Cluster1,Cluster2)
| eval Usage=if(isnotnull(UsageA),UsageA,UsageB)
| fields Cluster Usage
| sort - Usage | head 3

Thanks
KV
▄︻̷̿┻̿═━一

If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.