join query not returning result

[kajolsharma]

Hi, I have a query below with a join condition .The issue is if I am hardcoding name value I am getting the result but when I'm removing it, not seeing any results plus I m getting this error in screenshot.

Validated that it is not because of space issue .Can somebody suggest?

[kajolsharma]

Hi, i have modified the query :

index ="batch_monitoring"|search name=BPSP1060 |rex mode=sed field=name "s/ //g" |table "Activity Name",name,"job name",start,end,status,"Workstation Name _Job"|rename "Workstation Name _Job" as "Workstation"

But still I see no results when i use it with join query .

[richgalloway]

Why do you insist on running a query that doesn't match the one in the OP?  It doesn't prove anything.

If a query with a join is not returning expected results then it's necessary to run each side of the join independently and without changes.  Examine the results of those two queries to ensure they return 1) the expected field(s); 2) the field(s) that will be used to join results; and 3) common values in the joined field(s).

[kajolsharma]

Output of first query:

O/p of 2nd query:

You can see I have ran the 2 queries separately in the snips above. And you can find that the searched job result is present  in both the results. 

o/p of join query:[No result]

o/p of join query by putting a filter on that jobname:  [Its shows the result]

I hope you get what I trying to say.

[richgalloway]

Run each "side" of the join command separately.  Verify each returns a field called "name" and that the field has a common value on each side. 

[kajolsharma]

Yes, we do have name field in both queries. Refer below screenshot:

[richgalloway]

That's not the same query.  Please run this:

index=batch_monitoring | rex mode=sed field=name "s/ //g"