topic Re: How to execute a full outer join in splunk? in Splunk Search

How to execute a full outer join in splunk?

rkanumula — Fri, 03 Apr 2015 14:08:34 GMT

Hi,

i have a indexes A and B. when i am joining both indexes with type=outer, I am getting only left index data, but I want both columns of data. How do I do this?

ex:

Index A

id  name  sal
1    x    10,000

Index B

id desgn
1  eng

Now I want the output as:

id  name  sal     desg
1    x    10000   engineer

This is my current search:

index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal

Thanks in advance

Re: How to execute a full outer join in splunk?

richgalloway — Fri, 03 Apr 2015 14:23:26 GMT

Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try index=a | join type=outer id [search index=b] | table id name sal desgn ?

Re: How to execute a full outer join in splunk?

rkanumula — Mon, 28 Sep 2020 19:44:39 GMT

Got The Solution

Query:

index=a | join type=outer[ SEARCH index=b|rename id as id_cardNum]
|where id=id_cardNum|table id,name,desg,sal