Splunk Search

How to edit my join search to display all values of a field?

kranthi851
New Member

Hi All,

I'm trying to join two searches. Search A has user and signature. Search B has user and user details. Now I want to join two searches with user as the common field, but some values of signature in the searchA are missing in the final result as they don't have user. Is there any way to see all values of signature in the final table with user "unknown"?

Tags (2)
0 Karma
1 Solution

khreddy
Explorer

instead of
searchA | join user [searchB]

use
searchA | join type=left user [searchB]

By default join means inner join.
It will display only the matching records in searchA and searchB

View solution in original post

0 Karma

khreddy
Explorer

instead of
searchA | join user [searchB]

use
searchA | join type=left user [searchB]

By default join means inner join.
It will display only the matching records in searchA and searchB

View solution in original post

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!