i want to combine two source types and print the result

[lavanyaanne]

i have have two sourcetypes say sourcetype1 and sourcetype2 these two source type are in the same index
sourcetype1 has the fields CID and CN
sourcetype2 has the fields CID and Application

if in the two source types the CID matches i want to print the result CN,application
please help me

[woodcock]

Like this:

index=MyIndex (sourctype=sourcetype1 OR sourcetype=sourcetype2)
| stats dc(sourcetype) AS numSourcetypes values(*) AS * by CID
| search numSourcetypes=2
| table CN Application

[sundareshr · Accepted solution]

Try this

index=* (sourcetype=st1 OR sourcetype=st2) | stats dc(sourcetype) as count values(CN) as CN values(application) as application by CID | where count=2