Query Function Limitations
Some query functions have specific limitations in the way that they operate with multi-cluster views; specifically the ones that have complex flow of data and the ones that depend on state that may be inconsistent between clusters.
These functions use files which may not be consistent between clusters.
Uses the IOC database, which may not be consistent between clusters
Uses the ip location database which may not be consistent between clusters
join(),selfJoin(),selfJoinFilter(). However, ad-hoc tables are supported in multi-cluster views to perform join-like queries. See Using Ad-hoc Tables anddefineTable()for more information.