Comparing 2 searches using different sources?

[ckutach]

I am trying to make 2 searches using different indexes and sources

The first search is looking for all entries with "message sent" and the "Message Id". The second search is looking for the "Message Id" and "message sent".

 I am trying to find the number of messages that were sent but not received by comparing the message ID, and list the message IDs that were not sent

Example Attempt:

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId")  
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId")  
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*" 
| stats values(*) as * by messageId 

[yuanliu]

Something like

(index = exampleindex1 source = examplesource1 ("message sent" AND "MessageId") )
OR (index = exampleindex2 source = examplesource2 ("message received" AND "MessageId") )
| rex field=_raw "MessageId:(?<messageId>[\S]+)\s.*"
| rex "\bmessage\s+<?type>(sent|received)\b" ``` no need to specify field if _raw ```
| stats dc(messageId) as msgCount by type
| eval msgCount = if(type == "received", -msgCount, msgCount)
| stats sum(msgCount) as sent_not_received

You missed a couple parenthesis.