1. Be careful with the append command. It spawns a subsearch and therefore is limited by subsearch constraints (and can get finalized silently without producing full results). In your case you could ...
See more...
1. Be careful with the append command. It spawns a subsearch and therefore is limited by subsearch constraints (and can get finalized silently without producing full results). In your case you could either use multisearch since you have only streaming comands or a single search with conditional assignment or evaluation to get EventId properly assigned. index=index1 OR (index=index2 sourcetype=something) | eval EventId=coalesce(EventId,Number__c) (That's assuming that when you have Number__c in your event, you don't have EventId; if it's not the case, you have to use if() or case() with your eval). 2. To not only find if there are two matching events but which of them is missing if there is only one, you have to do it slightly differently. Firstly classify your events | eval classifier=if(index=index1,1,2) Now you can do | stats sum(classifier) by EventId This way you'll get a value of 3 when there are both events, 1 if there is only an event from index1 or 2 if there is only an event from index2.