This is the piece of code i tried so far but the join part is not working for me i don't know why
((index="ata" sourcetype="s:sv" y_id>=4 te>= [| makeresults
|eval start_date=strftime(relative_time(now(), "-30d@d"),"%Y-%m-%dT%H:%M:%SZ") | fields start_date | return $start_date] earliest=-90d@d [|join type="inner" id [search index="ys_kb" sourcetype="lys:b_l" y_id>=4
ble=1 | dedup id | fields id |return id ]]) OR (index="s_ata" sourcetype="lys:h_xl" os=* earliest=-90d@d))
Probably you could explain what are you trying to achieve. There might be a better solution than Join
Actually I want to use join in that particularly since the number of rows is more than 10,000
I tried using "inline search" but it not giving complete result Actually I was looking for the id that is present in that index ="ys_kb"