Please explain the below query and why the source i.e. source="dfw1lvpap415" is mentioned in the join ?
index="auto_preprod_sa3_host" ":" AND ("architecture" OR "cpu*" OR "CPU(s)" OR "model*" OR "Model*") | rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)-])"
| rex field=source "/output/(?.*\w\d)\_" | join Parameter [search index="auto_preprod_sa3_host" ":" AND ("architecture" OR "cpu*" OR "CPU(s)" OR "model*" OR "Model*") source="*dfw1lvpap415*"
|rex field=_raw "(?.*)\:\s(?.*\d+|\w+|[a-z0-9#.)])"] | table Parameter, abc,def,Server_Name | eval Message=if(match(abc,def), "Same","Not Same")
| search Parameter=* AND NOT (Parameter="Model name" OR Parameter="model name " OR Parameter="model " OR Parameter="cpu MHz ") | stats values(abc) AS Realtime_Configurations values(def) AS Reference_Configurations values(Server_Name) AS Server by Parameter Message
| where Message="Not Same"
... View more