Here is a simple set of records. to demonstrate the data (but not the two sourcetypes). The query would be more like index=myindex ( sourcetype=A OR sourcetype=B) . Lets say RequiredOnHand is sourcetype=B and the other Containers are in sourcetype=A. I would like to create the following list: 1. list Contains from sourcetype=A that match (or missing) from sourcetype=B Contains Basket Bunch Pint RequiredOnHand Apples 0 0 0 Bananas 0 0 Grapes 0 Oranges 0 0 Strawberries 0 0 2. list any Contains values in sourcetype=A that are not in sourcetype=B Contains Basket Balls 1 3. list any Contains values in sourcetype=B missing from sourcetype=A Contains Basket Kiwi 1 | makeresults | eval Container="Basket" | eval Contains="Apples" | eval From="FieldA" | append [|makeresults| eval Container="Basket"| eval Contains="Oranges" | eval From="FieldB" ] | append [|makeresults| eval Container="Bunch" | eval Contains="Bananas" | eval From="FieldC" ] | append [|makeresults| eval Container="Bunch" | eval Contains="Grapes" | eval From="FieldD"] | append [|makeresults| eval Container="Pint" | eval Contains="Strawberries" ] | append [|makeresults| eval Container="Pint" | eval Contains="Grapes" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Apples" | eval From="FieldA" ] | append [|makeresults| eval Container="RequiredOnHand"| eval Contains="Oranges" | eval From="FieldB" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Bananas" | eval From="FieldC" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Strawberries" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Kiwi" | eval From="FieldD" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Grapes" ] | append [| makeresults | eval Container="Basket" | eval Contains="Balls"| eval From="FieldA"] | chart count(Container) as chart-count over Contains by Container Results: Contains Basket Bunch Pint RequiredOnHand Apples 1 0 0 1 Balls 1 0 0 0 Bananas 0 1 0 1 Grapes 0 1 1 1 Kiwi 0 0 0 1 Oranges 1 0 0 1 Strawberries 0 0 1 1 Thanks for the help Oranges 0 0 Strawberries 0 0 2. list any Contains values in sourcetype=A that are not in sourcetype=B Contains Basket Balls 1 3. list any Contains values in sourcetype=B missing from sourcetype=A Contains Basket Kiwi 1 | makeresults | eval Container="Basket" | eval Contains="Apples" | eval From="FieldA" | append [|makeresults| eval Container="Basket"| eval Contains="Oranges" | eval From="FieldB" ] | append [|makeresults| eval Container="Bunch" | eval Contains="Bananas" | eval From="FieldC" ] | append [|makeresults| eval Container="Bunch" | eval Contains="Grapes" | eval From="FieldD"] | append [|makeresults| eval Container="Pint" | eval Contains="Strawberries" ] | append [|makeresults| eval Container="Pint" | eval Contains="Grapes" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Apples" | eval From="FieldA" ] | append [|makeresults| eval Container="RequiredOnHand"| eval Contains="Oranges" | eval From="FieldB" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Bananas" | eval From="FieldC" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Strawberries" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Kiwi" | eval From="FieldD" ] | append [|makeresults| eval Container="RequiredOnHand" | eval Contains="Grapes" ] | append [| makeresults | eval Container="Basket" | eval Contains="Balls"| eval From="FieldA"] | chart count(Container) as chart-count over Contains by Container Results: Contains Basket Bunch Pint RequiredOnHand Apples 1 0 0 1 Balls 1 0 0 0 Bananas 0 1 0 1 Grapes 0 1 1 1 Kiwi 0 0 0 1 Oranges 1 0 0 1 Strawberries 0 0 1 1 Thanks for the help
... View more
