I want to compare one field between two index. For example Field A. index A: Field A, Field B, Field C index B: Field A, Field D, Field E Now I want to grab all the data in tabular format as follows: Field A Field B Field C Field D Field E I tried using join function but the limitation of the join function is that the Field D and Field E are not captured in the search and displayed due to inner join. Is there something with full join functionality and displaying the results as displayed when using join function? My attempt: index = A sourcetype = A Field H = something | table Field A Field B Field C | join Field A [ search index = B sourcetype= B | table Field D Field E ] Desired result: Field A Field B Field C Field D Field E
... View more