Could someone explain why I have this kind of difference?
index=data sourcetype=st1 num=10 --> gives 2 results
index=data sourcetype=st2 num=10 --> gives 10 results
When I tried a join between st1 (first) and st2, I've got 2 results :
index=data sourcetype=st1 num=10 | join type=inner num [ search index=data sourcetype=st2 ] --> gives 2 results
When I tried a join between st2 (first) and st1, I've got 10 results :
index=data sourcetype=st2 num=10 | join type=inner num [ search index=data sourcetype=st1 ] --> gives 10 results
I heard that join is similar to SQL join but doesn't look that it works the same way. Any ideas?
... View more