How to search based on multiple indexes and their respective sourceTypes

[nainil0683]

Hi,

   I have index called Index1 which has sourcetype called SourceType1 and another index called Index2 with sourceType called SourceType2.

Some data is in combination of Index1<-> SourceType1 and some data is in combination of Index2<->SourceType2.

How can I write a query that targets the correct index and sourceType?

[nainil0683]

Yes, exactly like this.

I was beating around the bushes, but this one works perfectly.

Thanks a lot @sainag_splunk  👍

[sainag_splunk]

Glad it was helpful. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

[sainag_splunk · Accepted solution]

Do you mean like this ?

(index=Index1 sourcetype=SourceType1) OR (index=Index2 sourcetype=SourceType2)