I'm using JOIN expression to classify a type of errors. I want to have all errors classified like an eventtype to make searches, charts easier to future users.
For example 2 events:
1.First event has got the name(for example=xError) of process and its ID_Number (for example = 999).
2.Second event has got an information about exception -> "Caught exception" and same ID_Number = 999.
Edit: I want to have second event marked as eventtype=xError.
at first I suggest to use (if possible) stats command instead join because join is very slow, something like this:
index="test" Caught exception
| stats values(process) AS process values(information) AS information BY ID_Number
Anyway answering to your question, you cannot create an eventtype because there is one pipe, but as usefule workaround, you could create a macro containing your full search that you could use like an eventtype.
Obviously in this way you haven't all the fields of your index but only the ones that you put as values in your stats command.