Selective join

[sreelesh_n]

Trying out for below

1) sourcetype="A" has login details
2) sourcetype ="B" has success login details

When I select a list box/check box on failures, I want to show a list joining both details where a record is present in the success table.
If I select All, It should show just details from the user table. (more like outer join here)

[somesoni2]

Something like this might work (without join, have not seen your current query)

sourcetype="A" OR sourcetype="B" ..other base search | stats values(sourcetype) as sourcetype values(field1) as field1 values(field2) as field2 ... by common_field

Set following conditions based on checkbox selection

to show only items present in both

 | where mvcount(sourcetype)=2

To show all

 | where mvcount(sourcetype)>0