Wondering if this will work for you. It puts both datasets in the outer query. The first stats will pull all fields together by TraceID, then the where will remove those without data. The @t will contain multivalue dates which will get converted and then your next stats will collapse any duplicates. (index=test OR index=test2 source="insertpath" ErrorCodesResponse=TestError TraceId=*) OR
(index=test "Test SKU" AND @MT !="TestAsync: Request(Test SKU: )*")
| fields TraceId, @t, @MT, RequestPath
| stats values(*) as * by TraceId
| where isnotnull('@t') AND isnotnull('@mt') AND match('@mt', "Test SKU: *")
| eval date=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%Y-%m-%d"), time=strftime(strptime('@t', "%Y-%m-%dT%H:%M:%S.%6N%Z"), "%H:%M")
| stats values(date) as date values(time) as time values(@mt) as message values(RequestPath) as Path by TraceId
| where isnotnull(date) AND isnotnull(time) AND isnotnull(message)
| table date, time, TraceId, message, Path There may be more optimisations depending on your data.
... View more
