I have scenario where index and sourcetype are same and i am tryng below conditions.
chart dc(run) OVER app by event---- this will give me dc of run for each app for each event
stats dc(run) as run by app-- this will give me dc of run by app........
i used join to get this done ike below, but this is taking lot time to run query,
|chart dc(run) OVER app by event
| join app
[search source =mysource | stats dc(run) as run by app ]
|eval new_val = run - event1- event2
| fields app event1 event2 new_val new run
You can use append command to avoid join.
like the way you did join based on field app.
you can achieve same from append command.
example search is as below:
| search1 | stats count as count1 by app run
| append [search2 | stats count by app run1]
| stats values(*) as * by app
| do what ever you want
do not append all your raw events. you should append processed results from second search. this way you can improve the performance of search.