Real time table load

[anonuser]

I have a table with a join, which means there are 2 sources - x and y.  I receive the logs from x first, I would like to load the information from source x  in the table even if source y is still empty and then, load the information that is missing from y once I received the logs. Is it possible to be done?

[anonuser]

I reached out the result I wanted by using join type=left

[isoutamo]

Hi

This is the way how splunk is working. Just ingest data from different sources and combine those together with searches.
r. Ismo