I have 3 different sourcetype like Result , Node and error under same index. 
 Result has id , model 
 Node has address, id, resultid (which is key to id in result) 
 Error  has err_msg, id, nid (which is key to id in Node) 
 I want to export a result with stats count of err_msg by Node and model. I tried with joins and subquery with IN operator from other query but no luck. 
   
 index= index1 sourcetype = Node 
 [ search  index= index1 sourcetype = Error  | stats count by err_msg ] 
 | stats count by id,err_msg 
						
					
					... View more