Hi Team, I have a requirement that i'm writing a join query. Query-1 returns id ,time 5560007 2020-09-27 12:30:18.915 Query-2 returns ID, time, status 5560007 2020-09-27 18:49:13.757 Completed 5560007 2020-09-27 18:49:11.862 ActivityCompletedNotification 5560007 2020-09-27 18:49:08.781 Activity 5560007 2020-09-27 18:44:02.812 ActivityInProgressNotification I'm using outer join to join both query-1 and query-2 and i would need the latest value i.e. Completed from the Query-2. Currently, when i write an outer join, its randomly picking the values from the query-2. Query : index="xxxxxx" "5560007" | table id, _time | join type=outer id [ search index="xxxxx" "5560007" | table id, _time,notificationType | sort -_time] |table id,notificationType please help Many thanks!
... View more