Hunk - Join 2 Virtual Indexes

[tt1]

Hi,

I have 2 virtual indexes, both return data, and both return for a specific search.

But if I try and join and get no results, and if I try an 'or' I get no results.

index=filea ID=201 .. events

index=fileb ID=201 .. event

index=filea or index=fileb .. no events

index=filea or index=fileb | top 20 url .. no events

index=filea | join ID[fileb] .. no events

on one file the ID was found from within JSON format data, the other was done via an 'extract fields' from a messy log file.

Any thoughts appreciated.

[tt1 · Accepted solution]

'OR' instead of 'or' makes all the difference .....

that moment when joy is mixed with frustration ....

thanks for looking