Keep a search from excluding results

[pepper_seattle]

I have a search which pulls from two different sourcetypes on the same index. In this search I specifically call out '| search <field>=blah', however only one of the sourcetypes contains that field so the search effectively excludes all data from the other sourcetype.

As I have to keep my search setup like so 'index=blah sourcetype=1 OR sourcetype=2 |...| stats count by sourcetype' I cannot simply append them together like I'd hoped. Additionally, searching for my field parameter in that setup does the same exclusion of data, ex: index=blah sourcetype=1 field="blah" OR sourcetype=2 | ...| stats count by sourcetype'.

My question being, is there a way to run this query with my specific field search that won't exclude the data from the second sourcetype?

[pepper_seattle]

Thanks to both of you!

[acharlieh]

There are a few options. Parenthesis is one option... e.g.

index=blah ( (sourcetype=1 field="blah") OR sourcetype=2 ) | ... | stats count by sourcetype

Another option may be multisearch

| multisearch [search index=blah sourcetype=1 field="blah"] [search index=blah sourcetype=2] | ... | stats count by sourcetype

(multisearch is cooler when you have different streaming commands to apply to each subsearch.)

[woodcock · Accepted solution]

If I understand you correctly, like this (using parentheses to ensure proper logic):

index=blah ((sourcetype=1 field="blah") OR (sourcetype=2)) | ...| stats count by sourcetype'