Join Query

[chuck_life09]

I have an Index B  which has job_name and job_status details and another index A which has ticket number and job_name...

Index A to be joined with Index B to get the below details

ticket_number,job_name and job_status

I tried join type= inner job_name based on job_name
but i get empty results for job_status

what might be going wrong?

[richgalloway]

Please share the full query.

[chuck_life09]

Hi @richgalloway 

The sample query with index details as below.

Index A 

ticket number , job name

Index B

Job Name,Status

Query :-

index=A 
| table ticket_number,job_name
| join type=left job_name
[search index=B 
| table Job_Name, Status
|rename Job_Name as "job_name"
]

[richgalloway]

That query looks like it should work fine.  Just make sure the field names are exactly as they appear in the indexes.

If you still have trouble getting it to work, try this alternative query.

(index=A ticket_number=* job_name=*) OR (index=B Job_Name=*)
| rename Job_Name as job_name
| stats values(*) as * by job_name