subsearch join

[sarit_s]

Hello

I have a field that does not return results when searching for specific string. 

i need to combine two searches so i will be able to return this field + other results from the search with the specific string

this is my query :

sourcetype=clientlogs OR sourcetype="client-logs-api" 
Categories="Login"
| stats count(eval( Message="Unable to load " OR Message="Unable to load from SDK")) as Faliure, values(Message) as Message values(IPAddress) as IPAddress, values(Url) as url by Country SessionGuid 

| appendpipe 
    [ stats sum(Faliure) as Faliure 
    | fillnull value=0 Faliure 
    | eval Country="TOTAL" ] 
| appendpipe 
    [ stats count(SessionGuid) as FailedSessions 
    | eval Country="TOTAL",Faliure="Faliure"] 
]
| table SessionGuid IPAddress Country Faliure Message FailedSessions url 
| sort - Faliure

i need to add the field CID which return no results when searching for the message at the beginning of the query 

how can i join them together so i will see in the table also the values of CID ?

[ITWhisperer]

I am not sure I understand the requirement - do you want a list of CID where Categories != "Login" or a list of CID where message = "Unable to load " OR message = "Unable to load from SDK" or a list of CID where message != "Unable to load " AND message != "Unable to load from SDK" or something else?

[sarit_s]

I want list of CID's when 

sourcetype=clientlogs OR sourcetype="client-logs-api"

and add it to the table

[ITWhisperer]

| append [search sourcetype=clientlogs OR sourcetype="client-logs-api"
| stats values(CID) as CID]

[sarit_s]

CID still empty

[ITWhisperer]

So CID doesn't exist in these sourcetypes?

If it does, how would you list them?

[sarit_s]

It does. 
if im searching only for those sourcetyps i can find CID

but when i append this search with the rest it returns empty