Thanks a lot for the help 🙂 Unfortunately, this research did not bring me the expected result. The scenario looks like this: I have a "sourcetype" with approximately 1 million users, each user has a field identified as "userhashid".(index = drm sourcetype = drm_user_return) I have another "sourcetype" with all the licenses generated on the daily platform and each event exists in a field with name "userid". (index = ott sourcetype = drm_license) This field is the same as the "userhashid" field of the sourcetype "drm_user_return" Need something like a join (compare the userid with the hashuserid) so that you can use other fields from the sourcetype "drm_user_return" To remember. With the join function, many events with equal fields are not matching. I wonder if there is any alternative to join for this case.
... View more
