When nesting two commands using join, how can I verify if the Join command is returning the value of the field.
[code]
| join type=left ip
[
index=os s_ ip=10.x.x.x
| fields ip]
Never use join
. It should not even exist.
Hi djkj957,
Don't use join
for reasons.
Use a stats
instead and you will not hit any hidden limits:
[code] OR ( index=os s_ip=10.x.x.x | stats values(*) AS * by ip _time
Hope this helps ...
cheers, MuS