https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116518#M30953 <P>Also - if you are from DB/SQL background, keep in mind LOOKUP is like LEFT OUTER JOIN whereas JOIN is like INNER JOIN. The results are quite different</P> Wed, 15 Oct 2014 23:25:40 GMT bing_wu_mash 2014-10-15T23:25:40Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116514#M30949 <P>What are the big differences?</P> Tue, 21 Mar 2023 16:53:53 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116514#M30949 changwoo 2023-03-21T16:53:53Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116515#M30950 <P>Hi changwoo,</P> <P>A join is used to combine the results of a <STRONG>search</STRONG> and <STRONG>subsearch</STRONG> if specified fields are common to each. You can also join a table to itself using the selfjoin command.</P> <P>Use the lookup command to manually invoke <STRONG>field lookups</STRONG> from a lookup table that you've defined in transforms.conf. For more information, see <A href="http://docs.splunk.com/Documentation/Splunk/6.0.1/Knowledge/Addfieldsfromexternaldatasources">"Lookup fields from external data sources,"</A> in the Knowledge Manager manual.</P> <P>hope this helps ...</P> <P>cheers, MuS</P> Thu, 16 Jan 2014 06:26:33 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116515#M30950 MuS 2014-01-16T06:26:33Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116516#M30951 <P>thanks for your help</P> Thu, 16 Jan 2014 07:01:07 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116516#M30951 changwoo 2014-01-16T07:01:07Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116517#M30952 <P>Also - if you are from DB/SQL background, keep in mind LOOKUP is like LEFT OUTER JOIN whereas JOIN is like INNER JOIN</P> Wed, 15 Oct 2014 23:24:58 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116517#M30952 bing_wu_mash 2014-10-15T23:24:58Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116518#M30953 <P>Also - if you are from DB/SQL background, keep in mind LOOKUP is like LEFT OUTER JOIN whereas JOIN is like INNER JOIN. The results are quite different</P> Wed, 15 Oct 2014 23:25:40 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/116518#M30953 bing_wu_mash 2014-10-15T23:25:40Z https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/635355#M220732 <P>excellent. this is exactly what's important.</P><P>i'd also add this: there's No difference between "left join" and "left OUTER join".</P><P>ref.&nbsp;<A href="https://stackoverflow.com/questions/406294/left-join-vs-left-outer-join-in-sql-server" target="_blank">https://stackoverflow.com/questions/406294/left-join-vs-left-outer-join-in-sql-server</A></P> Tue, 21 Mar 2023 16:29:55 GMT https://community.splunk.com/t5/Splunk-Search/What-are-the-differences-between-join-and-lookup/m-p/635355#M220732 highsplunker 2023-03-21T16:29:55Z