Which record does a join function look at

[strehb18]

Hello Experts,

I am looking at an alert that is using a join function to match a work_center with a work order. I am wondering what records in a stream of records the join is looking at to get that result? Is there a way to get the latest result. 

To explain further, the work center in some cases will change based on where work is being completed, so I would like to grab the latest result when the alert runs. 

The current code I am looking at using this give us a way to compare the work center in the source="punch" vs the current stream of data. I am wondering if I can further manipulate that subsearch to look at the last result in source="punch". I tried a couple things but didn't have any luck. Not super familiar with joins in my normal work. 

| join cwo type left
[search source=punch
| rename work_center as position]

[gcusello]

Hi @strehb18,

if your requirement is to have only the last result and only one event, you could use something like this:

<your_search>
| join cwo type left
[search 
   source=punch index=your_index
   | rename work_center as position
   | sort -_time
   | head 1 ]

Only one hint: the join command is a very slow command and it consumes many resources; there are usually other solutions to replace the join command, e.g. the stats command, but this depends on your use case.

Ciao.

Giuseppe