Left outer join in splunk using |mstats

Splunk Enterprise

Is it possible to do left outer join after using two |mstats commands like below?

I have Process_Name common to both - but I want the ones that are not in the seconds |mstat command only.

| mstats prestats=t min("mx.replica.status") min("mx.process.resources.status") WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=10s BY service.name replica.name service.type 
| eval threshold="", pid="", cmd="", "host.name"="", "component.name"="" 
| mstats append=t prestats=t min("mx.process.threads")  WHERE "index"="metrics_test" AND mx.env=http://mx20267vm:15000 span=10s BY pid cmd service.type host.name service.name replica.name component.name threshold

Get Updates on the Splunk Community!

Build resilience for the agentic era: Join us at Splunk Go San Jose

AI is changing how organizations build, operate, and secure digital services. As teams adopt AI agents and ...

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...