https://community.splunk.com/t5/Getting-Data-In/Selective-join/m-p/222559#M43634 <P>Something like this might work (without join, have not seen your current query)</P> <PRE><CODE>sourcetype="A" OR sourcetype="B" ..other base search | stats values(sourcetype) as sourcetype values(field1) as field1 values(field2) as field2 ... by common_field </CODE></PRE> <P>Set following conditions based on checkbox selection</P> <P>to show only items present in both</P> <PRE><CODE> | where mvcount(sourcetype)=2 </CODE></PRE> <P>To show all</P> <PRE><CODE> | where mvcount(sourcetype)&gt;0 </CODE></PRE> Mon, 11 Jan 2016 17:05:01 GMT somesoni2 2016-01-11T17:05:01Z https://community.splunk.com/t5/Getting-Data-In/Selective-join/m-p/222558#M43633 <P>Trying out for below </P> <P>1) sourcetype="A" has login details <BR /> 2) sourcetype ="B" has success login details </P> <P>When I select a list box/check box on failures, I want to show a list joining both details where a record is present in the success table.<BR /> If I select All, It should show just details from the user table. (more like outer join here)</P> Mon, 11 Jan 2016 16:46:00 GMT https://community.splunk.com/t5/Getting-Data-In/Selective-join/m-p/222558#M43633 sreelesh_n 2016-01-11T16:46:00Z https://community.splunk.com/t5/Getting-Data-In/Selective-join/m-p/222559#M43634 <P>Something like this might work (without join, have not seen your current query)</P> <PRE><CODE>sourcetype="A" OR sourcetype="B" ..other base search | stats values(sourcetype) as sourcetype values(field1) as field1 values(field2) as field2 ... by common_field </CODE></PRE> <P>Set following conditions based on checkbox selection</P> <P>to show only items present in both</P> <PRE><CODE> | where mvcount(sourcetype)=2 </CODE></PRE> <P>To show all</P> <PRE><CODE> | where mvcount(sourcetype)&gt;0 </CODE></PRE> Mon, 11 Jan 2016 17:05:01 GMT https://community.splunk.com/t5/Getting-Data-In/Selective-join/m-p/222559#M43634 somesoni2 2016-01-11T17:05:01Z