How do I display and email search results from two different result sets?

[srungta]

How do I edit my current search?

index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |fields TXN_DESC |eval weborder=substr(TXN_DESC,1,10)| stats values(weborder) as weborder|join type=outer [ search index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* |stats count as totalevent|fields weborder,totalevent| search totalevent>10|sendemail from =user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true]

[sundareshr]

There are a couple of question I have with your current search..

1) Why do you need a join? Is it because you want to include totalcount and values(weborder)? Your base search is identical for both.

2) The reason you're probably not getting the expected results is, in your subsearch you have a stats that only returns the totalevent column and not the weborder column. To fix this, I would suggest you try the following, although without knowing your requirement, I am not sure this is will meet your need.

index=myindex sourcetype=A OR sourcetype=B earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* 
| eval weborder=substr(TXN_DESC,1,10)
| stats values(weborder) as weborder count as totalevent
| search totalevent>10
| sendemail from =user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true

[rafamss]

Hi srungta,

I would try to do this way:

(index=myindex OR index=myindex1) AND (sourcetype=A OR sourcetype=B) 
earliest=-72h ERROR_CODE=5014 AND TXN_DESC=W* 
| stats count as totalevent
| eval weborder=substr(TXN_DESC,1,10) 
| stats values(weborder) as weborder
| fields weborder,totalevent 
| search totalevent>10 
| sendemail from=user123@company.com to=mygroup@group.company.com server=mail.company.com use_ssl=true username="user123" user="user123" password="****" content_type=html subject="Partner API Resurrect Failure" message=weborder format=table,csv sendresults=true