I have 3 different sourcetype like Result , Node and error under same index.
Result has id , model
Node has address, id, resultid (which is key to id in result)
Error has err_msg, id, nid (which is key to id in Node)
I want to export a result with stats count of err_msg by Node and model. I tried with joins and subquery with IN operator from other query but no luck.
index= index1 sourcetype = Node
[ search index= index1 sourcetype = Error | stats count by err_msg ]
| stats count by id,err_msg
... View more