I am trying to join two different sourcetypes on IP address to detect traffic to malicious IP's .
The two sources are -Firewall Logs and Threat Intelligence logs (Malicious IP list).
The query runs fine when I make firewall logs as a sub search and the threat logs as the main search using join command.(i.e. Query A).Using this I am able to get the list for malicious IP's in firewall logs.
But vice versa does not gives any result (i.e. Query B)