Hi all, I have a search with a Join. For the event I am Joining the Master search may not always have corresponding events in the join/subsearch. Is it possible to also return the results from the master search if the join does not find corresponding events? index=*azure* *#EXT#* Operation="Add member to group."
|spath output=groupname path=ModifiedProperties{1}.NewValue
|spath output=TID path=Target{1}.ID
|eval time=strftime(_time,"%H:%M:%S %d-%m-%Y")
|rename UserId as src_user
|stats earliest(time) as start_time latest(time) as last_time values(Operation) as operation values(ObjectId) as dest_user by groupname,src_user, TID
| rename operation AS operation1
| table start_time, last_time, operation1, groupname, src_user, dest_user, TID
| join TID
[search index=*o365*
|spath output=TID path=Parameters{1}.Value
|eval time=strftime(_time,"%H:%M:%S %d-%m-%Y")
|rename UserId as src_user
|stats earliest(time) as start_time latest(time) as last_time values(Operation) as operation values(ObjectId) as dest_group by src_user, TID]
|table start_time, last_time, src_user, operation, operation1, dest_group, groupname, dest_user TID
... View more