As stated in the other question (https://answers.splunk.com/answers/726353/subsearch-returns-empty-value-main-search-also-ret.html) you can use a eval Title2=coalesce(Title2,"") to ensure your subsearch returns a valid result. ... View more

Ok. I apologize for it. ... View more

I made it work EXACTLY as your example data and mocked output requires. If you have other requirements, then update your question to show the additional detail in the Current data looks like and output should look like sections and I will have another shot. ... View more

I completely have no idea what you mean here. I think you need a complete do-over. ... View more

Hey nomadichunters try as below: index=main (sourcetype=firstquery OR sourcetype=secondquery) | stats values(FirstQueryValue1) as FirstQueryValue1, values(FirstQueryValue2) as FirstQueryValue2, values(SecondQueryValue1) as SecondQueryValue1, values(SecondQueryValue2) as SecondQueryValue2 by CommonField | fillnull ... View more