I'm trying to compare Field X from Index A with Field Y from Index B. Though the field names are different, they store the same value. IF value matches I need result from field Z from index B
Below is my search:
index = A |fields X |rename X as Y |join Y [|search index= B] |stats values(Z) by Y
Above search doesn't work.
Is it because of subsearch result limitation?
Help with the correct search to achieve it.
Thanks in advance.
↧