What is the precedence of common fields between the main search and subsearch after a join?

[bowesmana]

I have two types of log entry with a common field. I am using join to get the

index=web_load sourcetype=instrument i_tx=func1 i_status=0 | join i_bid [ search index=web_load sourcetype=instrument i_tx=func2 ] ...

The join is fine, but I am not sure what happens to fields that are in both rows with func1 and func2. I have a field i_elapsed which is the elapsed time for the function, but I am interested in min/avg/max stats about the i_elapsed field from the rows relating to func2. I can see a difference in my results if I reverse func1 and func2 round in the search, but am not sure what the rule is about common fields in the join.

[somesoni2 · Accepted solution]

Whether join subsearch fields overwrite the fields from main search is decided by following property of the join command.

overwrite
Syntax: overwrite=<bool>
Description: Indicates whether fields from the subresults overwrite the fields from the main results, if the fields have the same field name.
Default: true

By default the common field names would be overwritten. So, the query in the question should give you the desired result (using i_elapsed from func2/subsearch)

[bowesmana]

Duh RTFM!! I trawled through that page before I posted 😞 Just the answer I needed. Thanks!