https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169554#M48468 <P>I found a solution now!<BR /> It looks like this:</P> <P>sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *</P> <P>OR another way is this:</P> <P>sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2</P> <P>Greetings<BR /> C_Sparn</P> Mon, 19 May 2014 13:49:39 GMT C_Sparn 2014-05-19T13:49:39Z https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169551#M48465 <P>Hello,</P> <P>is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:</P> <P>sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]</P> <P>This gives me all events where field Number1 and field Number2 are equal and not equal.<BR /> How can I get just these events now, where they are not equal?<BR /> Thanks for help.</P> <P>C_Sparn</P> Mon, 19 May 2014 10:17:46 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169551#M48465 C_Sparn 2014-05-19T10:17:46Z https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169552#M48466 <P>Maybe something like this?</P> <PRE><CODE>sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB </CODE></PRE> Mon, 19 May 2014 11:40:17 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169552#M48466 richgalloway 2014-05-19T11:40:17Z https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169553#M48467 <P>This gives 0 results back. But thanks for the suggestion.</P> Mon, 19 May 2014 12:05:58 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169553#M48467 C_Sparn 2014-05-19T12:05:58Z https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169554#M48468 <P>I found a solution now!<BR /> It looks like this:</P> <P>sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *</P> <P>OR another way is this:</P> <P>sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2</P> <P>Greetings<BR /> C_Sparn</P> Mon, 19 May 2014 13:49:39 GMT https://community.splunk.com/t5/Splunk-Search/Problem-with-getting-all-non-matching-events-with-outer-join/m-p/169554#M48468 C_Sparn 2014-05-19T13:49:39Z