I have a search which pulls from two different sourcetypes on the same index. In this search I specifically call out '| search <field>=blah', however only one of the sourcetypes contains that field so the search effectively excludes all data from the other sourcetype.
As I have to keep my search setup like so 'index=blah sourcetype=1 OR sourcetype=2 |...| stats count by sourcetype' I cannot simply append them together like I'd hoped. Additionally, searching for my field parameter in that setup does the same exclusion of data, ex: index=blah sourcetype=1 field="blah" OR sourcetype=2 | ...| stats count by sourcetype'.
My question being, is there a way to run this query with my specific field search that won't exclude the data from the second sourcetype?
If I understand you correctly, like this (using parentheses to ensure proper logic):
index=blah ((sourcetype=1 field="blah") OR (sourcetype=2)) | ...| stats count by sourcetype'
There are a few options. Parenthesis is one option... e.g.
index=blah ( (sourcetype=1 field="blah") OR sourcetype=2 ) | ... | stats count by sourcetype
Another option may be multisearch
| multisearch [search index=blah sourcetype=1 field="blah"] [search index=blah sourcetype=2] | ... | stats count by sourcetype
(multisearch is cooler when you have different streaming commands to apply to each subsearch.)