Join Statment

[hartfoml]

OK the last question might have bee to hard for the group. So try this one.

I am using the join statement like this "search1 | join id [search2]"

In the primary search and in the sub-search there is a field called "id" but they do not always match.

I want to join on the field "search1 id=*" to "search2 key=*". "ID" and "KEY" always match.

I tried this but it did not work "search1 | join id:key [search2]"

I tried this but it did not work "search1 | join id,key [search2]"

I tried this to see if it would auto join, no luck "search1 | join [search2]"

Any help would be great.

[jonuwz · Accepted solution]

Sounds like you just need to abstract the different fields into something common you can join on

... | search1 | eval join_field=id | join join_field [ search2 | eval join_field=key ]

[fflloovee]

"eval join_field=id" Can i change id to field name because i have many id and want to join by id
i try to use "join type=left ID" and some value are missing(i search each value and see there refernce with id but still missing)

[hartfoml]

you have done it again twice in one day 🙂