Сombine several sourcetypes into one table сonsidering that one of the sourcetypes may not exist

[emerald]

I want to combine several sources into one table and I'm using this search:

sourcetype="firstsourcetype" somefield="value" | head 50 | join uuid [search sourcetype="secondsourcetype"] | join uuid [search sourcetype="thirdsourcetype"]

But if one of the sourcetypes doesn't exist, I don't get the data at all. I'm looking for a way to fix it.
Thanks in advance

[scelikok · Accepted solution]

Hi @emerald, you can fix by using join type=left as below;

sourcetype="firstsourcetype" somefield="value" | head 50 | join type=left uuid [search sourcetype="secondsourcetype"] | join type=left uuid [search sourcetype="thirdsourcetype"]

But, better/faster approach is using stats; you can add required fields with values function,

(sourcetype="firstsourcetype" somefield="value" ) OR sourcetype="secondsourcetype" OR sourcetype="thirdsourcetype" 
| stats values(somefield) by uuid 

If this reply helps you, upvote is appreciated.