Use two stats function with different group by

[rj]

how to get this two stats result in one query

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))

| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype

[rj]

thankyou for the reply ,is there is any other way of doing it 

[skramp]

You can try this, but I don't know if that is the solution you need:

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| fillnull dq
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq sourcetype

[rj]

yes ,i have two different searches ,but i need to use  output of one filed and to use in another

[skramp]

Then my solution seams to solve your problem. Have you tried to let it run like my suggestion was? Put the whole text (both blocks) into your search bar. 

[skramp]

(earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv")))
| stats latest(first) as first
latest(last) as last
latest(index) as index
by dev_id dq (this dq field is not present in ho_sum)

| append [search (earliest=-24h@h index="s_data_sum" (type="c" OR type="s") (sourcetype="ys:ho_sum" OR (sourcetype="ys:vo_cv"))) 
| stats latest(first) as first_vu
latest(last) as last_vu
latest(index) as index_1
by dev_id sourcetype]

Here you have one query but two searches but one result set. Using it this way isn't that nice because as mentioned you have two separate searches.