https://community.splunk.com/t5/Splunk-Search/How-to-use-join-with-data-model/m-p/215044#M63042 <P>You can do this without join itself (and it'll be much efficient)</P> <PRE><CODE>| tstats `summariesonly` dc(All_Traffic.src) as src from datamodel=Network_Traffic where All_Traffic.src_zone=outside All_Traffic.app!=incomplete All_Traffic.action=dropped OR All_Traffic.action=blocked [|inputlookup Denied_traffic.csv | table fieldInLookup | rename fieldInLookup as "All_Traffic.src] by All_Traffic.src </CODE></PRE> Thu, 05 Jan 2017 15:53:33 GMT somesoni2 2017-01-05T15:53:33Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-with-data-model/m-p/215043#M63041 <P>I have tried using join to detect the common field from lookup but i need not find the fields that are not present using data model query.</P> <PRE><CODE>|inputlookup Denied_traffic.csv | join type=inner All_Traffic.src[| tstats `summariesonly` dc(All_Traffic.src) as src from datamodel=Network_Traffic where All_Traffic.src_zone=outside All_Traffic.app!=incomplete All_Traffic.action=dropped OR All_Traffic.action=blocked by All_Traffic.src] </CODE></PRE> Thu, 05 Jan 2017 14:53:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-with-data-model/m-p/215043#M63041 prajesh 2017-01-05T14:53:29Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-with-data-model/m-p/215044#M63042 <P>You can do this without join itself (and it'll be much efficient)</P> <PRE><CODE>| tstats `summariesonly` dc(All_Traffic.src) as src from datamodel=Network_Traffic where All_Traffic.src_zone=outside All_Traffic.app!=incomplete All_Traffic.action=dropped OR All_Traffic.action=blocked [|inputlookup Denied_traffic.csv | table fieldInLookup | rename fieldInLookup as "All_Traffic.src] by All_Traffic.src </CODE></PRE> Thu, 05 Jan 2017 15:53:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-with-data-model/m-p/215044#M63042 somesoni2 2017-01-05T15:53:33Z