search query

[aokhovat]

Splunk new-bee here. Let's say I have two records in the log file: one record has " myID=1234 ticker= abc" and the other record does not have the "ticker" field but only "myID" tag as in " myID=1234" . How can a search based on ticker=abc pick up these two records? Note the second record does not have "ticker" and search is based on ticker=abc. Thanks

[Vijeta]

@aokhovat you can do
|eventstats values(ticket) as ticker by myID| search ticker=abc