Update reference table join docs (#27573)

* Update filter_by_reference_tables.en.md

* Add files via upload

* Update advanced_search.md

* Update layouts/shortcodes/filter_by_reference_tables.en.md

Co-authored-by: Esther Kim <[email protected]>

* Update layouts/shortcodes/filter_by_reference_tables.en.md

Co-authored-by: Esther Kim <[email protected]>

* Update content/en/logs/explorer/advanced_search.md

Co-authored-by: Esther Kim <[email protected]>

* Delete static/images/logs/explorer/advanced_search/reference_table_join_filter.png

* Add files via upload

---------

Co-authored-by: Esther Kim <[email protected]>

content/en/logs/explorer/advanced_search.md

@@ -74,7 +74,7 @@ In this example, use `service:network_directory` as your main query, and then de
 
 {{% filter_by_reference_tables %}}
 
-{{< img src="logs/explorer/advanced_search/reference_tables_logs.png" alt="The Datadog Log Explorer with reference table search options highlighted" border="true" popup="true" style="width:100%;" >}}
+{{< img src="logs/explorer/advanced_search/reference_table_join_filter.png" alt="The Datadog Log Explorer with reference table search options highlighted. Includes numbered steps aligned with prior instructions" border="true" popup="true" style="width:100%;" >}}
 
 ## Further reading
 

layouts/shortcodes/filter_by_reference_tables.en.md

@@ -2,13 +2,15 @@
 
 Reference Tables allow you to combine metadata with logs, providing more information to resolve application issues. Add a query filter based on a Reference Table to perform lookup queries. For more information on creating and managing this feature, see the [Reference Tables][101] guide.
 
-To apply a query filter with Reference Tables:
+To apply a query filter with Reference Tables, click the **Add** button next to the query editor and select **Join with Reference Table**.
 
-1. Click the **Add** button next to the query editor, and then select **Join with Reference Table**.
 1. Select your reference table in the dropdown menu.
-1. Select the log field you want to look for in the reference table.
-1. Select the **IN** or **NOT IN** operator depending on whether you want to find the field value in the specific column.
+2. Select the log field to join on.
+3. Select the **IN** or **NOT IN** operator to filter in or out matching logs.
+4. Select the Reference Table column to join on.
+5. (Optional) Select Reference Table columns used to enrich logs.
+6. (Optional) Filter logs by directly querying data in Reference Table columns.
 
-In the following example, the Reference Table query filter is used to search all recent logs that include a malicious IP address from a threat intel reference table:
+In the following example, a Reference Table containing product information is used to filter and enrich logs:
 
-[101]: /integrations/guide/reference-tables/
+[101]: /integrations/guide/reference-tables/