I'm having the same problem. Mine doesn't work with the inner or left join, although I can see the event from the left join, but without the fields from the other source.
index=IDX_A event.url = "http://some.url"
| rename event.ts_srcip as dest_ip
| join dest_ip [search index=IDX_B]
I can confirm the main query and the subsearch, return results when executed separately. The IDX_A has the field event.ts_srcip which is wrong and should be the dest_ip. The IDX_B has the field dest_ip and has the correct src_ip field, which is what I'm trying to get from this join.
... View more