Please see this search - i'm trying to add missing field values from another index to this search. index=1 earliest=-9d latest=now ExternalApiType=Event_DetectionSummaryEvent | fillnull | stats values(ComputerName) AS ComputerName values(DetectName) AS DetectName values(UserName) AS User values(event_platform) AS Platform values(FileVersion) AS SensorVersion P values(MachineDn) AS OU values(SiteName) AS SiteName count(_time) AS count BY _time EventUUID | sort 0 - _time | eval Time=strftime(_time, "%m/%d/%Y %H:%M:%S") | appendcols [ search earliest=-9d latest=now index=json "AuditKeyValues{}.Key"=new_state "AuditKeyValues{}.ValueString"=* | spath | spath AuditKeyValue{} ] Index=1 has fields ComputerName, DetectName, UserName, _time, EventUUID index=main has fields event_platform, FileVersion, MachineDn, SiteName I want to pull the fields from index=main into the stats command of the index=1. I thought it's as simple as adding the index=main at the beginning of the search with an OR: (index=json ExternalApiType=Event_DetectionSummaryEvent) OR (index=main FileVersion=*). But it's not working. I have to have the ExternalApiType value and it's only in the first index. I also tried join with the subsearch, but it didn't work. The original search is for 90 days, so I shouldn't use a subsearch anyways. Thank you.
... View more
