How to join inner?

[marceldera]

Inter join is not displaying any results.   the search works however, nothing is showing up on the screen

index = tenable | rename hostnames as host.name | table host.name | join type=inner host.name [search (index=assetpanda) | fields host.name] | table host.name

[gcusello]

Hi @marceldera,

I suppose that you already checked that there are matching values!

Anyway, the problem is probably in the limit of 50,000 values of the subsearch.

So you need to limit the values of the subsearch or (better!) use a different approach!

please the approach and adpt it to your need:

index = tenable OR index=assetpanda
| eval hostname=coalesce(hostname,host.name)
| stats dc(index) AS index_count values(index) AS index BY hostname
| where index_count=2
| table hostname

in general, avoid to use fields with spaces or special chars as dot.

Ciao.

Giuseppe