https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300385#M90437 <P>index=index2 sid=* | join type=left sid [search index=index1 sid=* ] | table sid did</P> <P>this is working</P> Wed, 15 Feb 2017 18:57:38 GMT sravankaripe 2017-02-15T18:57:38Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300380#M90432 <P><span class="lia-inline-image-display-wrapper" image-alt="alt text"><img src="https://community.splunk.com/t5/image/serverpage/image-id/2488iA2EEE7CC3B8B275F/image-size/large?v=v2&amp;px=999" role="button" title="alt text" alt="alt text" /></span></P> <P>i have two indexes i have Sid common in both </P> <P>i want to display Sid and Did in a table.<BR /> Please help me with join condtion.</P> Wed, 15 Feb 2017 16:59:39 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300380#M90432 sravankaripe 2017-02-15T16:59:39Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300381#M90433 <PRE><CODE>index=index2 sid=* | join type=left sid [search index=index1 sid=* | fields sid ] | table sid did </CODE></PRE> <P>This assumes index2 has sid &amp; did, and index1 has just sid</P> <P>Basically mirror your image and follow the docs: <A href="http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/SearchReference/Join">http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/SearchReference/Join</A></P> Wed, 15 Feb 2017 17:09:04 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300381#M90433 jkat54 2017-02-15T17:09:04Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300382#M90434 <P>Is there a common field between those two indexes? If I understand correctly you're trying to get what a SQL right outer join will give, is it correct?</P> Wed, 15 Feb 2017 17:12:33 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300382#M90434 somesoni2 2017-02-15T17:12:33Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300383#M90435 <P>Sid is a common field.<BR /> Yes, it is similar like SQL Right join .</P> Wed, 15 Feb 2017 18:33:57 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300383#M90435 sravankaripe 2017-02-15T18:33:57Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300384#M90436 <P>How about this? (will keep events with sid common and sid only in index=B, the right outer join)</P> <PRE><CODE>index=A OR index=B | stats value(did) as did values(index) as indexes by sid | where isnotnull(mvfind(indexes,"B")) </CODE></PRE> Wed, 15 Feb 2017 18:49:49 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300384#M90436 somesoni2 2017-02-15T18:49:49Z https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300385#M90437 <P>index=index2 sid=* | join type=left sid [search index=index1 sid=* ] | table sid did</P> <P>this is working</P> Wed, 15 Feb 2017 18:57:38 GMT https://community.splunk.com/t5/Splunk-Search/help-me-with-join-condition/m-p/300385#M90437 sravankaripe 2017-02-15T18:57:38Z