You don't need a subsearch and using join/append are rarely necessary and should be avoided where possible. Subsearches have limitations. You just need to search both datasets at the start with an (...
See more...
You don't need a subsearch and using join/append are rarely necessary and should be avoided where possible. Subsearches have limitations. You just need to search both datasets at the start with an (A) or (B) search then collect them together with stats. I am not sure why you are using eventstats - you don't need that and it will not perform well anyway. Try this. (index=a component=serviceA "incoming data")
OR (search index=a component=serviceB "data from")
| stats values(name) as name ,values(age) as age, values(parentName) as parentName ,values(parentAge) as parentAge by id1,id2
| eval mismatch=case(isnull(name) AND isnull(age) ," data doesn't exist in serviceA",
isnull(parentName) AND isnull(parentAge) ," data doesn't exist in serviceB",
true, "No mismatch")
| table name,age,parentAge,parentName,mismatch,id1,id2