** edit: ** if i add dedup _time,clientip to the left (upper) search, i get 2580 events. Hi, ive got this search: host=tutorialdata _time=* clientip=* | eval test1=0 | fields clientip _time t...
See more...
** edit: ** if i add dedup _time,clientip to the left (upper) search, i get 2580 events. Hi, ive got this search: host=tutorialdata _time=* clientip=* | eval test1=0 | fields clientip _time test1 | join type=left clientip, _time [ search host=tutorialdata _time=* clientip=* | transaction clientip maxspan=6h | eval test2=1 | fields clientip _time test2] | eval testFinal= if(test2 == "1","1","0") | stats sum(testFinal) the search left to the join alone, returns 39532 events. the right one, alone, 2580. i added the test1, 2, and testFinal to verify the results, but if i run the whole search it sums up 3457 instead of 2580. whats going on? thanks