As @PickleRick says, join is rarely the best option and something based on the approach outlined may be your way forward. Having said that, if you still want to go forward with a join, to answer your...
See more...
As @PickleRick says, join is rarely the best option and something based on the approach outlined may be your way forward. Having said that, if you still want to go forward with a join, to answer your question about how to get earliest - 60m, you could do this index=myindex
| fields a, b, c
| join type=inner left=l right=r where l.keyid=r.keyid
[search index=myindex [ | makeresults
| addinfo
| eval latest=info_max_time
| eval earliest=relative_time(info_min_time, "-60m")
| table earliest latest]
|fields d, f
]
| table l.a, l.b, l.c, r.d, r.f The addinfo command tells you what time parameters were used for the initial search.