I have two indexes with digital certificate information ( indexA and IndexB ). I used the join command to add some fields that the index does not have through the common field Site. I need to make a merge between the two indexes as there are data that only the IndexA contains, and others that only contains IndexB . Currently this syntax: index=IndexA | where HIERARCHY="1" |rename CN AS Site| join Site type=left max=0 [search index="IndexB" | dedup _raw | rename "Certification object" AS Site|fields Site,"Expiry Date","CI Name","Serial Number",Environment,SupplierName] |dedup Hostname Site "Valid to" TIMESTAMPENTRADA2 | table Hostname Site "Expiry Date" I tried the option type=outer , but remained the same result. I also tried to use index=indexA OR index=IndexB , but didn't work. ... View more