This issue continually bites me and there's something I'm just not understanding. If I search like so: sourcetype=one | join common_field [ search sourcetype=two ] | table one_field, one_field_two, one_field_three, two_field_one, two_field_two The resulting table will often be missing fields such as one_field_two and return them empty, even when the data is there. I understand that if I'm doing a " | stats" on some fields, they will definitely get returned, but could someone explain how I otherwise explicitly ensure fields from one, two or both get returned as non-empty values? I'm not doing a stats here, I just want a table and want those values returned. ... View more

I've got a query like this: sourcetype=blahdeblah earliest=... latest=... | stats .... | join ..[ search ... | more stats ... ] | eval date_numericmonth=strftime(_time,"%m") | sort date_year desc, date_numericmonth desc, date_mday asc | table fields .... date_year, date_month, date_mday, date_numericmonth Why is date_numericmonth empty in the resulting table? The sorting works as you would expect, and date_month shows up in the table just fine, so the date_numericmonth has a meaningful value, but for some reason I can't get it to show up in the results. ... View more

I have a query much like the following. The anonymization, if I did it well, should make my intention more clear: sourcetype=log_car | rename carID as joinID | join usetime=true earlier=true max=1 joinID [search sourcetype=log_seat | rename id as joinID ] | join usetime=true earlier=true max=1 main_id date_year date_month date_mday [search sourcetype=log_seat | stats count as number_seats by mainID, date_year, date_month, date_mday] | stats count AS cars_with_seats, sum(Price) AS total_car_value by mainID, date_year, date_month, date_mday Every car has at least one seat. The first join is to lookup all the data for the "main" (the special, driver seat designated by the joinID) seat for that car. This data is aggregated, so I'm displaying the number of cars, and their summed value, broken down by day. That part is fine, where it gets hairy is that I also want to know the total number of seats in each car. There could be thousands (this analogy is not perfect...). In order to count the number of seats in each car, I added a second join which joins not on the joinID field, but on the mainID and on the day, so the aggregation will work. That returns results, but the number_of_seats is not in the final table. Therefore, I think my question is, "how do I make the number_of_seats be available in the final table?" and that might have a quick, simple answer. But if my idea of doing a second join against the same sourcetype is backwards and wrongminded, then my question is as originally posed, how do I count the number of rows in a join? This is complicated by the aggregation going on in the stats call, as I want to see the number of seats in each car, on each day. Any thoughts? ... View more