I am trying to perform a join on two log events if they come from the same _sourceHost. There is nothing else in the two events that i can perform a join on. How would I do this? If I do on x._sourceHost = y._sourceHost it gives me me this error "x__sourceHost in the condition cannot be found in subqueries."
Please sign in to leave a comment.