Corelating independent searches.

[joydeep741]

I have 2 absolutely independent searches.

Search-1 gives me the availability of server throughout the day.
Sample data :
9am - 100
9.30am - 100
10am - 100
10.30am - 0
11am - 100
11.30am - 100

Search-2 gives me the time range for planned outages
10am to 11am
3pm to 4pm

So I have to build a logic to timechart Search-1 and if the time is BETWEEN the planned outage TIME RANGE than hard code the availablity to 100.

I am not able to co relate 2 different searches reffereing 2 different sourcetypes of the same Index.
Need help.

[DalJeanis]

Rather than trying a join or correlation, there's a much easier way: append the data from the second search to the first search and then use stats to get the max of the two values.

your search that gives your uptime  with _time and status
| append [ search ... your search that gives each time of scheduled outage with _time and status 100 ...]
| stats max(status) as status by _time

[joydeep741]

1) There is no co relation with respect to _time
2) Second search results in start and end time stamps.