I have a search that will return 95% of what I need from a single search, however the last piece of data I need is not in those events. I can join on an id in the search results to get the info I need from the subsearch, but when I do that the stats count that works fine without the join, seems to only return a subset or distinct count of events when joined and reported on with data from the subsearch
In other words they search itself finds 951 results, but the table built totals only 48 events.
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf
I do not see your closing "]"
as rmaccum says
you forgot to close the second subsearch with "]"
close it and rerun your search
let me know if it work
Sorry, yes I was closing it but mistyped. The data seems correct, but it seems to only return a subset of the count
| searchA errorfield
| join type=left joinfield [searchB
| fields joinfield field1]
| stats counterrorfield AS numOf by field1 voy_errDescription
| xyseries errorfield,field1,numOf