@Vijeta, Yes, you are right. The 2 rows I was getting as the OrderId from different indexes had different case, one is lower and other is Capital. Solved it by using lower() method
| eval OrderId = lower( coalesce( OrderId, OrderId2) )
But the other issue still remains, i.e. the I still get the OrderIds from the second index for which the corresponding events from first index are filtered out. And that is the reason I am getting some entries in the table for which forumId is empty.
I only want the OrderId in the table which are from both indexes after the filtering.
... View more