Subquery Does Not Return Any Result

[pramit46]

I have two different sourcetypes: S1 and S2 (under different indexes)

I want to print, three extracted custom fields from those two sourcetypes: F1 & F2 (belong to S1) and F3 (belongs to S2). I used the following query:

sourcetype= S1 or sourcetype= S2 | fields F1, F2, F3

It shows "No results found."

Basically, my motive is to print the values of certain fields from these two sourcetypes including F1, F2 & F3.

When I use: sourcetype= S1 | fields F1, F2 it comes up nice.

F1, F2, F3 can be multivalued fields which may or may not contain same values.

Any suggestions?

[MuS · Accepted solution]

Hi pramit46,

Your search brings no result, because you will not have any events containing all three fields. You only have either F1 and F2 or F3.

But to get all three fields try something like this:

 sourcetype=S1 OR sourcetype=S2 | stats values(F1) AS F1, values(F2) AS F2, values(F3) AS F3 

hope this helps ...

cheers, MuS

[pramit46]

Thanks @MuS,
I tried that, too.. But did not get much luck. then I realized that I had to use the or as OR and it worked.