Hi @diogofgm , this approach didn't work for me. It brings the values from second one as well. I am trying to check the first approach with left join and inner join that @Sukisen1981 provide us here. Anyway, thank you! ... View more

@Sukisen1981 , thank you again for our reply! So let me get if I understand. This part (original from my question) index=ABC sourcetype="perf" CLASS=PL| fields RR_ID USR_ID | dedup RR_ID | join type=left RR_ID [search index=CAB sourcetype=CC | fields rrId| rename rrId AS RR_ID] will bring me ALL values of the first index AND no unique values from the second, correct? The second join that you mentioned "when your second join gets performed you get ONLY values unique to both A&B (A intersection B).", you mean with this additional part (join type=inner) after the left join? index=ABC sourcetype="perf" CLASS=PL| fields RR_ID USR_ID | dedup RR_ID | join type=left RR_ID [search index=CAB sourcetype=CC | fields rrId| rename rrId AS RR_ID] | join type=inner RR_ID [search index=CAB sourcetype=CC | fields rrId| rename rrId AS RR_ID] | stats count by USR_ID I am still in this part thinking that with this additional join I will get as you mention the A intersection B, not the final part that you mentioned with only the left (join left results). ... View more

Hi Sukisen1981! Thank you for your reply. I implemented here and apparently works well but I split the searchs to understand why I need to use a new join (inner) after the left join. I thought that the left join will bring only the results in first search not in the second but brings me everything. The query whitout the join inner I try to bring the columns from first search and second but as the reference column is RR_ID, could I rename and bring in distinct columns to check that in the second search I will have values and other raws with no value? ... View more