I must have missed that part in my original post, sorry I had to edit my real search a lot to disguise the nature of the data it is used against. I do indeed have a join element, that line should read:
| join outer Div [search....
The search that I have works correctly now with the exception that it runs based on the current "MODE" of the server and not the "MODE" of the server at the time of the incident.
To better clarify the issue, the outer join search needs to run with a dynamic latest event time for each event in the original search. The first search returns a lot of events that occurred, the second search shows mode changes of the server and I need to confirm the mode that the server was in at the time of each event, not just its current mode. Therefore, I need to dynamically run the second search based on the time of the event that each first search item occurred.
I'm not certain at this point but I think that it can't be done with a join and will require a map search instead.
... View more