Help to use join to combine based on alert field

[vkrishnachand]

i have two tables A and B. Based on alert field value in table A a corresponding row will be generated in table B.

i am going to use join to to combine both table A and B values based on alert field.

In some cases in table A the alert field value will be null so there wont be corresponding rows generated in table B , but i want to display these exception rows as well.

Please tell me how to achieve this.

[martin_mueller]

What do you mean by "table"?

[vkrishnachand]

this is a table command indeed and not a table :-).

[woodcock]

I am going to take you literally even though I know it will generate an incorrect solution. You have not given us much with which to work. Try this:

| inputlookup TableA
| eval sourcetype="TableA"
| appendpipe [
| inputlookup TableB
| eval sourcetype="TableB"
]
| rename COMMENT AS "You probably don't have tables so maybe you need 'index=foo sourcetype=TableA OR sourcetype=TableB' instead"
| stats values(*) AS * dc(sourcetype) AS num_sourcetypes BY YourCommonFieldHere
| fillnull YourSometimesMissingButImportantFIeldNameHere value="YourChosenDefaultValueHere"

[vkrishnachand]

many thanks for your prompt response a left type left join seems to produce good results :-).

[woodcock]

There are many problems with join and it does not scale. Use a solution like mine.

[niketn]

@vkrishnachand, can you add some data sample from table A and table B and your existing queries. Can you also explain what you mean by exception rows without any data? What is alert field?

Please provide more details of your issue for us to assist you better.

[vkrishnachand]

many thanks for your timely response.I managed to design the query with type left join and it seemed to work :-).