Hi @yuanliu  The query you suggested below working fine in our non prod.But in non prod its taking lot of time to fetch the query or though records are present its giving no result. Is there performance issue with this query when we are searching across 2 sources types having more traffic in prod . Any suggestions would be really helpful. sourcetype IN (sourcetype_1, sourcetype_2) | bin span=5m _time | eventstats values(s1_field1) as s1_field1 values(s2_field1) as s2_field1 values(s2_field2.CID) as CID values(s1_field1.ID) as ID by _time | where s1_field1 == s2_field1 AND CID == ID | fields - s2_field1 ID | stats latest(*) as * by s1_field1 CID _time   ... View more

Thank you for the response. The below link says   ... View more

Thank you for the response. your all inputs were really helpful. ... View more

Hi .. No I am not referring where command and eventstats conditions from the query. After the query output i am getting all the fields of both the sources(as giving | stats values(*) as ..) .Including field3. I am giving the token name as field3 and also in the query passing as $field3$.but its not working as its present only in any one of the sources. what I am assuming is to have this dropdown option in dashboard value should be present in both the sources and then only it filters from the dashboard . is the understanding correct ? ... View more

Hi .. Query and initial ask is same ,No change to it . what i meant by filtering is that adding dropdown in dashboard as below for field3. so in order to have this working value should be present in both the sources ,otherwise it wont work ? is the understanding right ? ... View more

Thank you for clarifying.It was helpful and it worked for me. Just one clarification ,with this query have created dashboard and added drop down filtering options for few fields from both the source types.its working for the common fields name ,but field which is present in any of the source is not having ,though record is present its saying no result found. filter searching is not working for s1_field3 and s2_field3 .Is it something filtering works only for common fields across both the sources ? ... View more

Thank you for your response. @yuanliu what I meant to say was I am using below query by giving time range option in splunk option sourcetype IN (sourcetype_1, sourcetype_2) | eventstats values(s1_field1) as s1_field1 values(s2_field1) as s2_field1 values(s2_field2.CID) as CID values(s1_field1.ID) as ID by _time | where s1_field1 == s2_field1 AND CID == ID | fields - s2_field1 ID | stats values(*) as * by s1_field1 CID I am seeing strange behaviour initially query seems giving expected output.after a while when I again when submit again and its not giving any output at all.It says no results found though there are records (events) available.Query sometimes fetches the results and sometimes it won't. any suggestions on what I might be missing ? ... View more

Hi Below query is exactly giving the expected output ,But I am using without the time range.(bin span=5m _time) what I am observing is its giving me duplicate results.Meaning I am expecting only one entry but after while result set is increasing with same duplicate records. any suggestions ? sourcetype IN (sourcetype_1, sourcetype_2) | bin span=5m _time | eventstats values(s1_field1) as s1_field1 values(s2_field1) as s2_field1 values(s2_field2.CID) as CID values(s1_field1.ID) as ID by _time | where s1_field1 == s2_field1 AND CID == ID | fields - s2_field1 ID | stats values(*) as * by s1_field1 CID @yuanliu ... View more

Thank you for the detailed information and multiple options. I will be creating dashboard with this use-case and having filter to select the timerange in dropdown. so in the query would be fetching based on values matches against 2 sources. I will try these queries and keep you posted. Thank you again ... View more

I will try this .Thank you ... View more

Thank you for the response. Apologies for the multiple threads. I did try below both the queries you have suggested and its fetching only the fields of source1 .(i.e CID, Cname ,CData). Source2 fields are not being combined and fetched. I am not sure what am missing here .Please suggest. sourcetype="source1" OR sourcetype="source2" | eval common=if(sourcetype="source2",key,CID) | stats values(*) as * by common sourcetype="source1" OR sourcetype="source2" | eval common=if(sourcetype="source2",Key,CID) | eval CID=if(sourcetype="source2",CID,null()) | stats values(*) as * by common | fields - common sourcetype Key ... View more

Thank you for your patience and response. Just briefing here with sample data.Please suggest. sourcetype= source1 "CID": 123 "Cname": John "CData": XYZ sourcetype= source2 "CID": 285 "Key": 123, "FName": Ken "LName": Dan Here CID(source1) = Key(source 2) so I need result in below format: "Cname": John "CData": XYZ "CID": 285 "FName": Ken "LName": Dan But with the below query I am seeing the result like below: sourcetype="source1" OR sourcetype="source2" | eval common=if(sourcetype="source2",key,CID) | stats values(*) as * by common "common": 123 "CID": 123 "Cname": John "CData": XYZ There are no fields of source 2(FName,LName) is fetched here ... View more

Thank you for the response. it is fetching only the fields of source 1 and not combining the fields of both source 1 and source 2:( In below CID will be taken from source 1? my use case is to match key of source 2 and CID of source 1But CID present in both the sources. | eval common=if(sourcetype="source2",key,CID) ... View more

Thank you for the response. Yes, that is what I am looking for . But the catch here is CID is present in both source1 and source 2. source1: CID, Cname, CData Source 2: CID, key, FName, LName But i need to match CID of source 1 and key of source 2.Since CID field name is common in both the sources its not fetching properly as combined results .Its giving 2 rows of data for each sources having fields as null for other source. Hope I am making it clear. Please suggest . ... View more

Hi, I have similar usecase ,But ProcessId is present both the source types.But i need to match the data ProcessId of source1 and NetStatPID of source2. Since field name(ProcessId) is common in both the sources ,it's not working fine. Please suggest.   ... View more

Thank you for the response. I have tried this and not working. As i need to match CID of source 1 and Key of source 2 are same then fetch all the fields of source1 and source 2.One thing to note here though CID is present in source 2 it will be having different value.so need to match if(CID(source1) equals to key(source2) then fetch all fields of source1 and source2). please suggest. ... View more

Thank you for the response. I have tried the above query.But it doesn't seems to be working as coalesce is not matching if the values of CID(source1) and Key(source 2 ) same .Also its displaying only the fields of source 1.Fields of source 2 are not being fetched. ... View more