When nesting two commands using join, how can I verify if the Join command is returning the value of the field.
[code] | join type=left ip [ index=os s_ ip=10.x.x.x | fields ip]
Never use join. It should not even exist.
join
Hi djkj957,
Don't use join for reasons.
Use a stats instead and you will not hit any hidden limits:
stats
[code] OR ( index=os s_ip=10.x.x.x | stats values(*) AS * by ip _time
Hope this helps ...
cheers, MuS
