https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195168#M56278 <P>This worked perfectly. Thank you!!</P> Wed, 30 Oct 2019 19:44:30 GMT brandonhough 2019-10-30T19:44:30Z https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195166#M56276 <P>I have a search between two data sets using join, let's say sourcetype A and B.<BR /><BR /> My search looks like this:<BR /><BR /> <BR /><BR /> sourcetype=A fieldA |eval fieldB=fieldA|join fieldB [search sourcetype=B fieldB]</P> <P>The results i am receiving is the list of all the events where fieldA in A is the same as fieldB in B.<BR /><BR /> What I am trying to receive is the list of fieldA that doesn't exist in B.<BR /><BR /> Can someone please help me with this ?</P> <P>Regards,<BR /><BR /> Jonathann</P> Wed, 19 Mar 2014 17:01:15 GMT https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195166#M56276 jonthanze 2014-03-19T17:01:15Z https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195167#M56277 <P>Try to have join type left, which will give all the details.</P> <PRE><CODE>sourcetype=A fieldA |eval fieldB=fieldA|join type=left fieldB [search sourcetype=B fieldB] </CODE></PRE> <P>Thanks</P> Wed, 19 Mar 2014 17:13:35 GMT https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195167#M56277 linu1988 2014-03-19T17:13:35Z https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195168#M56278 <P>This worked perfectly. Thank you!!</P> Wed, 30 Oct 2019 19:44:30 GMT https://community.splunk.com/t5/Splunk-Search/inverse-join-in-Splunk/m-p/195168#M56278 brandonhough 2019-10-30T19:44:30Z