I have made an inquiry on having a subsearch that will allow the user to:
1) within one index, search two different sourcetypes for an item (url and/or host)
2) if the item is found in sourcetype(A) then sourcetype(B) is ignored
3) if the item is found in sourcetype(B) then sourcetype(A) is ignored
4) produce the search result
5) sourcetype (A) is the primary (B) is the secondary
the search string below works but produces search results from both sourcetypes
index=* sourcetype=(A) OR sourcetype=(B) | eval search=case(sourcetype == (A), "true", sourcetype == (A), "false" , 1=1, "true")
| search "url=" OR "dest_nt_host=*" | eval search=if(isnull(url),elsefield,dest_nt_host)
Do the two sourcetypes have any common fields to match them on?
if you changed your eval to this:
| eval search=if(sourcetype == (A), "true", "false" )
does it evaluate correctly?
the result is the same either way