How to edit my join search to display all values of a field?

[kranthi851]

Hi All,

I'm trying to join two searches. Search A has user and signature. Search B has user and user details. Now I want to join two searches with user as the common field, but some values of signature in the searchA are missing in the final result as they don't have user. Is there any way to see all values of signature in the final table with user "unknown"?

[khreddy · Accepted solution]

instead of
searchA | join user [searchB]

use
searchA | join type=left user [searchB]

By default join means inner join.
It will display only the matching records in searchA and searchB