how multiple sourcetype stats

[nnonm111]

There are multiple sourcetypes in index="main".
I'm trying to stats at SOURCETYPE number one and I need a field of sourcetype number two. Is there any way?

[PickleRick]

Again, I don't understand 😉

What do you mean "add the src_network="internet0" condition fo www1"? If you don't have this field in the event, you can't filter by it. Do you want to add this field your events?

Maybe show us a sample of your events and a desired output.

[PickleRick]

Please be a bit more elaborate on what you want to do. We know that you have events of two different sourcetypes in one index. But what do you want to do with them?

Get separate stats for each sourcetype? You can do that with the BY clause in stats or tstats.

Something else? Please be more specific.

[nnonm111]

Ex)
--------------------------------

index="www" Source="www1"
index="www" source="www2"

--------------------------------

My spl:

index="www" source="www1"  status="200"
stats values(src_ip) by dest_ip

--------------------------------

index="www" source="www1"  src_network ="internet0"

--------------------------------

source="www1" does not have an Internet0 field.

I'd like to add the src_network="internet0" condition of www1 to My spl.