How to combine two different searches?

[mgrosholz]

I am looking to grab the data that fall under two completely different searches.

I have these two searches.

index="A" 
| iplocation src 
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, usr1
| where count > 25

AND

sourcetype="B" 
| bucket _time span=1m
| stats count by _time, usr2
| where count > 25

I want to combine them. Here is what I have so far but it doesn't pull up the data.

index="A" OR sourcetype="B" 
| eval id=case(index="A", "usr1", sourcetype="B", "usr2")
| iplocation src 
| search Country!="country1" status=200
| bucket _time span=1m
| stats count by _time, id
| where count > 25

sourcetype="B" does not contain iplocation or country information. This, I believe, is the issue.

I have tried subsearches, join, append, etc...
Any advise is appreciated.

[somesoni2 · Accepted solution]

Give this a try

 index="A" OR sourcetype="B" status=200
 | eval id=case(index="A", "usr1", sourcetype="B", "usr2")
 | eventstats values(src) as src1 by id | eval src=coalesce(src,src1)
 | iplocation src 
 | search Country!="country1" 
 | bucket _time span=1m
 | stats count by _time, id
 | where count > 25

[mgrosholz]

Awesome. It worked. Can you explain why?

[somesoni2]

The eventstats was the trick. After | eval id=case(, you'll a common field between both index=A and sourcetype=B. Using this common field, the eventstats added the src to events in sourcetype=B where it was not earlier. After that since src was available in all events now, iplocation and Country based filter worked.

[mgrosholz]

Ahhh. Makes sense now. Thank you.