https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-join-search-to-display-all-values-of-a-field/m-p/241463#M71810 <P>instead of <BR /> searchA | join user [searchB]<BR /><BR /> use <BR /> searchA | join type=left user [searchB] </P> <P>By default join means inner join.<BR /> It will display only the matching records in searchA and searchB</P> Mon, 09 May 2016 17:54:05 GMT khreddy 2016-05-09T17:54:05Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-join-search-to-display-all-values-of-a-field/m-p/241462#M71809 <P>Hi All, </P> <P>I'm trying to join two searches. Search A has user and signature. Search B has user and user details. Now I want to join two searches with user as the common field, but some values of signature in the searchA are missing in the final result as they don't have user. Is there any way to see all values of signature in the final table with user "unknown"?</P> Mon, 09 May 2016 16:36:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-join-search-to-display-all-values-of-a-field/m-p/241462#M71809 kranthi851 2016-05-09T16:36:35Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-join-search-to-display-all-values-of-a-field/m-p/241463#M71810 <P>instead of <BR /> searchA | join user [searchB]<BR /><BR /> use <BR /> searchA | join type=left user [searchB] </P> <P>By default join means inner join.<BR /> It will display only the matching records in searchA and searchB</P> Mon, 09 May 2016 17:54:05 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-join-search-to-display-all-values-of-a-field/m-p/241463#M71810 khreddy 2016-05-09T17:54:05Z