https://community.splunk.com/t5/Splunk-Search/Hunk-Join-2-Virtual-Indexes/m-p/148420#M41512 <P>Hi,</P> <P>I have 2 virtual indexes, both return data, and both return for a specific search.</P> <P>But if I try and join and get no results, and if I try an 'or' I get no results.</P> <P>index=filea ID=201 .. events</P> <P>index=fileb ID=201 .. event </P> <P>index=filea or index=fileb .. no events</P> <P>index=filea or index=fileb | top 20 url .. no events</P> <P>index=filea | join ID[fileb] .. no events</P> <P>on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.</P> <P>Any thoughts appreciated.</P> Wed, 12 Feb 2014 22:22:00 GMT tt1 2014-02-12T22:22:00Z https://community.splunk.com/t5/Splunk-Search/Hunk-Join-2-Virtual-Indexes/m-p/148420#M41512 <P>Hi,</P> <P>I have 2 virtual indexes, both return data, and both return for a specific search.</P> <P>But if I try and join and get no results, and if I try an 'or' I get no results.</P> <P>index=filea ID=201 .. events</P> <P>index=fileb ID=201 .. event </P> <P>index=filea or index=fileb .. no events</P> <P>index=filea or index=fileb | top 20 url .. no events</P> <P>index=filea | join ID[fileb] .. no events</P> <P>on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.</P> <P>Any thoughts appreciated.</P> Wed, 12 Feb 2014 22:22:00 GMT https://community.splunk.com/t5/Splunk-Search/Hunk-Join-2-Virtual-Indexes/m-p/148420#M41512 tt1 2014-02-12T22:22:00Z https://community.splunk.com/t5/Splunk-Search/Hunk-Join-2-Virtual-Indexes/m-p/148421#M41513 <P>'OR' instead of 'or' makes all the difference ..... </P> <P>that moment when joy is mixed with frustration ....</P> <P>thanks for looking</P> Thu, 13 Feb 2014 08:08:02 GMT https://community.splunk.com/t5/Splunk-Search/Hunk-Join-2-Virtual-Indexes/m-p/148421#M41513 tt1 2014-02-13T08:08:02Z