Splunk Search

Why is a join on the _cd field to correlate search results to a specific event not returning any values?

New Member

I want to join with search results and correlate to the specific event. Trying _cd field, but it doesn't appear to return any values.

index=main * | join _cd [search *]

I was expecting to see some bucket and address values?

earliest="-1s" * | rex field=_cd "(?<bucket>d+):(?<address>d+)"
Tags (3)
0 Karma

Motivator
0 Karma