Join is much more efficient. Is it possible to fillnull on a join so that I can collect the results for events for which there isn't an event to join?
sourcetype=1 | join host [ search sourcetype=2 | fields host,result ] | table host,result
Join is much more efficient. Is it possible to fillnull on a join so that I can collect the results for events for which there isn't an event to join?
sourcetype=1 | join host [ search sourcetype=2 | fields host,result ] | table host,result