I have 2 searches and i want to join the results of both of them into 1 table of x_requestid's. The respective result column in each search has a different name
Search 1:
index=A number=RU status=SUBMITTED | table x_requestid
Search 2:
index=A status=INELIGIBLE | rename request_id as x_requestid | table x_requestid
These individual searches provide exactly what I need, but when I try to join them I get nothing. Here's my join query
index=A number=RU status=SUBMITTED | table x_requestid | join x_requestid [search index=A status=INELIGIBLE | rename request_id as x_requestid | fields x_requestid] | table x_requestid
... View more