How do I fill my null field from a subsearch?

[jsven7]

Situation:

• The data I need resides in the below:

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

Problem:

• "fieldD" only has a value when I modify the search as such:

index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

--------------------------------------

Based on my research I presume I am 100% incorrect but I've been trying to use join with no success. I suspect the answer is to use a subsearch however I can't figure out how to construct it so that I can always get a value for "fieldD". Any help would be greatly appreciated.

[ITWhisperer]

| fillnull value="N/A" fieldD

[jsven7]

index=X (sourcetypeA=X NOT fieldA=X) OR (sourcetypeB=X NOT fieldB=X)

Apologies I failed to mention that I actually need to retrieve the value of "field D" from the above search so that its displayed in the below search:

index=X (sourcetypeA=X fieldA=X) OR (sourcetypeB=X fieldB=X)
| rename fieldA as fieldB
| stats count by fieldC, fieldD, fieldE, fieldB

[ITWhisperer]

| stats count values(fieldD) as fieldD by fieldC, fieldE, fieldB

[jsven7]

Thank you for your assistance. That did not work. Here is the join example I attempted. It might give a better idea at the problem I'm facing:

index=X
``` Dataset 1. When fieldA has a value fieldD is missing. ```
(sourcetype=sourcetypeA fieldA=X) OR 

``` Dataset 2. When fieldA has a value fieldD is missing.  ```
(sourcetype=sourcetypeB fieldB=X)

| rename fieldA as fieldB

| fillnull value="N/A" fieldD

``` This is the only way I presume I can append fieldD to my dataset. fieldD is only available when fieldA and fieldB above don't have values. ```
| join type=left fieldC [search index=X sourcetype IN (sourcetypeA,sourcetypeB) fieldD="*"]

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB

Problem: fieldD="N/A"

[ITWhisperer]

Depending on your actual events, try something like this

index=X (sourcetype=sourcetypeA OR sourcetype=sourcetypeB)

| eval fieldB = coalesce(fieldB, fieldA)

| eventstats values(fieldD) as fieldD by fieldC

| where fieldA=X OR fieldB=X

| stats count by fieldA, fieldC, fieldD, fieldE, fieldB