I have 2 virtual indexes, both return data, and both return for a specific search.
But if I try and join and get no results, and if I try an 'or' I get no results.
index=filea ID=201 .. events
index=fileb ID=201 .. event
index=filea or index=fileb .. no events
index=filea or index=fileb | top 20 url .. no events
index=filea | join ID[fileb] .. no events
on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.
Any thoughts appreciated.
'OR' instead of 'or' makes all the difference .....
that moment when joy is mixed with frustration ....
thanks for looking
View solution in original post