How to use fillnull in one sourcetype while using IN

[dtccsundar]

Hi ,

Like below ,

Sourcetype =Fire

Name	OS	Compare_Version	Compare_Agent Installed	sysid
ABC11	windows	10.1	2.2	qweq

Sourcetype =Compare

Name	OS	Fire_Version	Fire_Agent Installed	sysid

After doing ,
index=A sourcetype IN (Compare,Fire)

| stats values(*) as * by sysid 
| mvexpand Name
| stats values(*) as * by Name

Since the sourcetype =Compare   has empty row for particular sysid or Name , i am not getting exact output.Its null ,so i need to fill null value="" in the sourcetype which has no rows and the same is required for other scenario too(when sourcetype=Fire has no data and sourcetype =Compare has data).

Please let me know a search which accomodates this too .

[ITWhisperer]

| fillnull value=""

[dtccsundar]

Thank you !!

Is there a way to do something like this ,

index=A sourcetype IN (Compare|fillnull value="",Fire)|fillnull value=""

OR 

index=A sourcetype IN (Compare,Fire|fillnull value="")|fillnull value=""

[ITWhisperer]

I have no idea what these two searches are trying to achieve, however, do you mean something like this

index=A (sourcetype=Compare AND value="") OR sourcetype=Fire|fillnull value=""

[dtccsundar]

I am using below query,

index=A sourcetype IN (Compare,Fire)| fillnull value="" | search ITAM_Name="*SWZWZQ0001*" OR ITAM_Name="*SADAPP0002*" OR ITAM_Name="*SALINU0016*" OR ITAM_Name="*SGGRNP1002*"

| stats values(*) as * by ITAM_sysid
|eval Status=if(F_Agent_Version ="" AND C_Agent_Version ="","Not Covered","Covered")
| table sourcetype ITAM_sysid ITAM_Name F_Agent_Version C_Agent_Version Status

sourcetype	ITAM_sysid	ITAM Name	Fire Agent Version	Compare Agent Version	Status
Compare      Fire	0003fb	SALINU0016	32.30.	6.3	Not Covered
Compare                    Fire	003fcb	SGGRNP1002	29.7		Not Covered
Fire	0d456	SADAPP0002	32.3		Covered
Compare	0d526	SWZWZQ0001			Not Covered

Due to the null's in the first and second rows (SALINU0016,SGGRNP1002) for Agent_version and Compare Agent Version , i am getting "Not covered" instead of covered.Please let me know ,how to get rid of nulls and make the status Covered .