https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350021#M174854 <P>Hi, <BR /> I have an Index=A and inputlookfile where I'm trying to get a list of computers which are not common in 'index =A and Inputlook file B, I tried to do a left join on the 'computer' name from index =A on input look file , but I'm not getting the desired result. <BR /> Could you please let me know if we can do a left outer join in spunk to get the resultset which is not common in both the index OR lookup file?</P> <P>--Thanks</P> Wed, 26 Apr 2017 01:14:29 GMT snam 2017-04-26T01:14:29Z https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350021#M174854 <P>Hi, <BR /> I have an Index=A and inputlookfile where I'm trying to get a list of computers which are not common in 'index =A and Inputlook file B, I tried to do a left join on the 'computer' name from index =A on input look file , but I'm not getting the desired result. <BR /> Could you please let me know if we can do a left outer join in spunk to get the resultset which is not common in both the index OR lookup file?</P> <P>--Thanks</P> Wed, 26 Apr 2017 01:14:29 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350021#M174854 snam 2017-04-26T01:14:29Z https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350022#M174855 <P>Is this OK?</P> <P>(A) ※(outer | left）JOIN<BR /> index =A |join type=outer computer [|inputlookup B] </P> <P>(A NOT B)<BR /> index =A NOT [|inputlookup B|fields computer]</P> <P>(A AND B)<BR /> index =A |join type=inner computer [|inputlookup B] <BR /> OR<BR /> index =A [|inputlookup B|fields computer]</P> <P>(A OR B)<BR /> index =A |append [|inputlookup B] </P> <P>(When making it unique)<BR /> ･････ |stats latest(*) AS * BY computer<BR /> OR<BR /> ･････ |dedup computer</P> Wed, 26 Apr 2017 04:58:35 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350022#M174855 HiroshiSatoh 2017-04-26T04:58:35Z https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350023#M174856 <P>I tried the above solutions and it didnt work.</P> Wed, 26 Apr 2017 15:41:23 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350023#M174856 snam 2017-04-26T15:41:23Z https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350024#M174857 <P>Can you present samples of search statements and lookup files?</P> Thu, 27 Apr 2017 02:16:48 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-Left-outer-join/m-p/350024#M174857 HiroshiSatoh 2017-04-27T02:16:48Z