Why are results still coming back blank after using join using multiple source type?

[pratibha0610]

Hi team,

I wonder if someone can help me with the below query.  I have a to combine my two searches with join. With first search i get the assignement group and with second search i get email of those assigment group to send alert. 

i have common values between two sourcetype but field name is different.  in the first serach, field is called dv_name and in second it is called name. Therefore i create name variable before using join. However my field email is still coming blank

 serach:

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name | stats values (dv_email) values (name) by name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

[ITWhisperer · Accepted solution]

Since you are dedup'ing name, there will only be one value (the first) for dv_email so the stats becomes unnecessary. (The reason you were getting no results is that the field created by the stats command is "values(dv_email)" not dv_email - you could fix this (if you still want to use stats) by stats values(dv_email) as dv_email by name.)

index=production sourcetype=call
| eval name=dv_name

| join name type=left

[ index=production sourcetype=mail  earliest="04/30/2022:20:00:00" latest=now() | dedup name]

| eval Email=if(isnull(dv_email), " ", dv_email) 

| table dv_name Email

[pratibha0610]

@ITWhisperer  thanks a lot!! my search worked.

I also wanted to check one thing for setting up alert to send mail to Email address popped in result. Will the below solution work?

Enable send email alert action and in to: field set $result.Email$