I'm trying to use a key across three sourcetypes to show unique non-multivalue rows using a stats by clause that has a different field in each of the sourcetypes
i.e.
Sourcetype A
NumberA(Key) Date (by clause)
Sourcetype B
NumberB(Key) Username (by clause)
Sourcetype C
NumberC(Key) Version (by clause)
if you use the number field, which is the key across the sourcetypes, as the stats by clause and add the different sourcetype fields as values, it produces multivalue fields (e.g. a number may have multiple dates, or users), where I'm looking for unique rows to show number, Date, Username, Version
e.g.
sourcetype=A OR sourcetype=B OR sourcetype=C
eval number=coalesce(NumberA, NumberB, NumberC)
stats values(sourcetype) values(Date) values(Username) values(Version) by number
I would have thought that you could add the different fields to the stats by clause after the key, but it's not returning anything-
e.g.
sourcetype=A OR sourcetype=B OR sourcetype=C
eval number=coalesce(NumberA, NumberB, NumberC)
stats values(sourcetype) by number Date Username Version
Would this make sense, and is possible?
