Combining two different events with same values from different source types

[gvjyothi45]

index=a0_payservutil_generic_app_audit_prd sourcetype="npp:pom:stdout" eventCode="fundsReservationManualInterventionNeeded"

index=prod_payments OR index=a0_payservutil_generic_app_audit_prd sourcetype="npp:cbis:techevent" $selected_ID$ | rex mode=sed field=_raw "s/\x1f/|/g"

| eval fields=split(_raw,"instructionReceiptIdentification=")

| eval RN=mvindex(fields,1)

| eval Recp=split(RN, "'")

| eval ReceiptNumber=mvindex(Recp, 2)

| eval EntityID=mvindex(Recp, 6)

|dedup ReceiptNumber

|table _time, ReceiptNumber, EntityID

The above two queries i am having it. First query identify the entity id which is having 'manualinterventionneeded' and second query get the receipt number by using that entity id. Entity ID in first query and instructionReceiptIdentification in second query having the same values. By matching these two values i want to get one query to create an alert.

Could you please help me on this ?

[diogofgm]

First combine both queries:

(index=a0_payservutil_generic_app_audit_prd sourcetype="npp:pom:stdout" eventCode="fundsReservationManualInterventionNeeded") OR (index=prod_payments OR index=a0_payservutil_generic_app_audit_prd sourcetype="npp:cbis:techevent" $selected_ID$) 

Then you need to combine the 2 fields from both searches into one. Then use the coalesce function to fill an ENTITY field with the values of first valid following the order inside function. This should be placed after any eval or regex used to extract these fields.

| eval ENTITY = coaalesce(EntityID, instructionReceiptIdentification)