How to edit my search to get the required common value?

[sumanssah]

I am trying to create an rule with 2 information "Expected Host Not Reporting" & "Network Device Interface Down"

I would expect common host name from both searches, however not getting common host name with below mentioned search

| `host_eventcount(30,2)` | search is_expected=true | stats count by host | appendcols [search source="udp:50001" facility=ETHPORT port_status=down |stats count by host] |

BR
......SS

[woodcock · Accepted solution]

The appendcols command is joiner-agnostic; it does a blind row-to-row merge of the 2 datasets. This is clearly not what you are desiring; it appears that you are trying to do a merge of the 2 datasets based on a common key so try this:

index=AlwaysUseAnIndexSpecifierYouNaughtyUser sourcetype="IJustToldYouAlwaysUseSpecifiersWhenYouCan" source="udp:50001" facility=ETHPORT port_status=down
| appendpipe [| `host_eventcount(30,2)` | search is_expected=true ]
| stats count(eval(port_status=down)) AS PORT_DOWN_COUNT count(eval(is_expected=true))) AS SOME_OTHER_COUNT BY host

It would be clearer if you used count(eval(sourcetype="A")) and count(eval(sourcetype="B")) but I had to go with what I could see in your searches.