How to use join using stats by count on two different searches?

[msrama5]

Hello, I am trying to use the join by userid on 2 different sub queries using join feature, both the queries are returning the data when individually ran, but is not returning the data when used with join, what is missing in query below to join by userid ?

earliest=-1h sourcetype=GATEWAY | stats count by UserId , cc.Type, Error.Code 
| table first_table | join UserId   [ | search earliest=-1h sourcetype=GATEWAY  ReasonCode="Authorized"| stats count by UserId , cc.Type|  table second_table]

[woodcock]

Start with this:

earliest=-1h sourcetype=GATEWAY
| stats count count(eval(ReasonCode="Authorized")) BY UserId , cc.Type, Error.Code

[somesoni2]

Get rid of those | table first_table and | table second_table. The table command is to selectively show the fields from result of the search, so your current searches are trying to return fields 'first_table' and 'second_table' which do not exist and join fails.