i have a indexes A and B. when i am joining both indexes with
type=outer, I am getting only left index data, but I want both columns of data. How do I do this?
id name sal 1 x 10,000
id desgn 1 eng
Now I want the output as:
id name sal desg 1 x 10000 engineer
This is my current search:
index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal
Thanks in advance
Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try
index=a | join type=outer id [search index=b] | table id name sal desgn ?