union search with same field from different sourcetype

[lllidan]

I have two sources as below:
source x:

CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01 | 1 | 2019/02/02 | 2 |
source y:

ID,UserName,.......
1 | Tom
2 | Jack

my expected output:
CreateTime, CreateUser,ChangeTime,ChangeUser,.......
2019/01/01| Tom |2019/02/02 | Jack |

do you have any idea? Thanks in advance.

[gcusello]

Hi lllidan,
try something like this:

index=my_index (sourcetype=sourcetypeA  OR sourcetype=sourcetypeB)
| rename ChangeUser AS ID
| stats values(CreateTime) AS CreateTime values(CreateUser) AS CreateUser values(ChangeTime) AS ChangeTime values(UserName) AS UserName BY ID
| fields - ID
| rename UserName AS ChangeUser
| table CreateTime CreateUser ChangeTime ChangeUser

If you have more fields to add, use the values(fields) AS field approach.

Ciao.
Giuseppe

[lllidan]

it seems doesn't work, the query values(fields) can only extract the value of fields, but can't show the relationship between two sourcetype, when the field ChangeUser is "2" , it must mapping to sourceB and find ID equal 2, and got the UserName=Jack=ChangeUser=2