How to search two Indexes, but only use the dedup command for fields in one index?

[boingodevin]

I would like to search two different SourceTypes where one SourceType pipes a dedup command on fields that only that index hasaccess to and while the other index contains all its events. Is this possible? If so how would it be performed?

Example:

index="myIndex" source="source1" [search index="index2" source="source2" | dedup state]  my_field_1="1*" | ....more_commands_followed...

[lguinn2]

Are you sure that you want "dedup"? dedup does not remove fields, it removes events that have duplicate values for the named fields. In your example, you are using a subsearch - I am pretty sure that you don't want to do that - a subsearch returns events that become selection criteria for the outer search; the events from the subsearch are not part of the results.

Please tell us what you are trying to do, as I think there may be a better way overall. Or maybe I am just confused and don't understand the question. But here is an answer to your question, sort of. To combine inputs from multiple sources, and dedup based on fields that appear in only one of the sources:

index="myIndex" source="source1"  my_field_1="1*"
| append [ search  index="index2" source="source2" | dedup state ]

If you want the criteria my_field_1="1*" to apply to both searches, do this

index="myIndex" source="source1"  my_field_1="1*"
| append [ search  index="index2" source="source2" my_field_1="1*" | dedup state ]