It sounds like you want to use a subsearch to use your criteria on the B side to whittle down the total RequestId values being received. After that you want to just use stats to group things by the RequestId. Any other fields you need like AgentUserName, throw it in the stats (here I've just added it as an extra group by field because that generally makes the most sense for categorical fields. The final stats with the values(foo) clause might not be exactly what you want ultimately but it matches your question.
index=app host=hostB source=sourceB sourcetype=B
[ search index=app source=sourceA host=hostA sourcetype=A timeoutSvc=*
| rename requestId AS RequestId
| table RequestId
]
| stats count by AgentUserName RequestId
| stats values(AgentUserName)
Now if you want to carry something through to the end from the A side, like the timeoutSvc values, that's pretty simple. Here we still use the A criteria in the subsearch to whittle down the RequestId's, but then we feed this into a disjunction amounting to A OR B.
index=app ( host=hostB source=sourceB sourcetype=B ) OR ( source=sourceA host=hostA sourcetype=A timeoutSvc=* )
[ search index=app source=sourceA host=hostA sourcetype=A timeoutSvc=*
| rename requestId AS RequestId
| table RequestId
]
| stats count by AgentUserName RequestId timeoutSvc
| stats values(timeoutSvc) values(AgentUserName)
... View more
