I have 2 sourcetypes:
Eg. sourcetypeA has fields such as ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum
sourcetypeB has fields such as Name, GroupID, PhoneNum, VAS1, VAS2
When I search using PhoneNum ONLY, the result needs to display PhoneNum, GroupID, DeviceUsed, DeviceSerialNum
Thank you guys but none of the above works.
The field name of the groupid is different in both sourcetype although groupdid is found in the field#2 of both sourcetype
Thank you, guys but none of the above works.
The field name of GroupID of sourcetypeA is different from sourcetypeB although both GroupID are found on field#2 in both sourcetype.
Try like this
(sourcetype=sourcetypeA) OR (sourcetype=sourcetypeB PhoneNum="YourSearchedPhoneNumHere")
| fields GroupID, DeviceUsed, DeviceSerialNum PhoneNum
| stats values(PhoneNum) as PhoneNum values(DeviceUsed) as DeviceUsed values(DeviceSerialNum) as DeviceSerialNum by GroupID
| where isnotnull(PhoneNum)
@hkchew
try this
sourcetype=sourcetypeA | fields ServiceProvider, GroupID, DeviceUsed, DeviceSerialNum | join GroupID [ search sourcetype=sourcetypeB | fields PhoneNum, VAS1, VAS2 ] | search PhoneNum=* | table PhoneNum, GroupID, DeviceUsed, DeviceSerialNum
i hope this helps