I want to find the duration of time for only one sourcetype where as the other values for both the sourcetype..
stats range(_time),values(field_a) by sourcetype,field_b |search sourcetype=abc
The above is not helping,coz field_a value is not present in sourcetype abc,so am recieving null value .
you have to modify your stats command:
| stats earliest(_time) AS earliest latest(_time) AS latest values(field_a) by sourcetype field_b | search sourcetype=abc
In this way you have the borders of your time range.
In this case, you could try to run something like this:
your_search sourcetype=sourcetype_a | stats earlist(_time) AS earliest latest(_time) AS latest values(field_a) AS field_a BY sourcetype | append [ search your_search (sourcetype=sourcetype_a OR sourcetype=sourcetype_b) | stats values(field_a) AS field_a BY sourcetype ] | stats values(earliest) AS earliest values(latest) AS latest values(field_a) AS field_a BY sourcetype
in this way you have, from the first search, earliest and latest and the other fields for sourcetype_a, and then, from the second search, you have the details for both the sorcetypes.