Hello!
I am having a problem with this query:
index=myIndex
| join FIELD1 max=0 [search index=myOtherIndex | stats values(FIELD2) as FIELD2 by FIELD1]
When I look a the result of the query, the FIELD2 is not multivaluate, it is composed of a single line with space between the values, instead of a multivalued field.
If I run the search index=myOtherIndex | stats values(FIELD2) as FIELD2 by FIELD1
(without the join), I get the correct result, which is a multivaluate FIELD2.
It seems like the join command is somewhat interfering with the properties of the fields?
Does anyone have a clue on what's going on?
Thanks!
Guilhem