Splunk Search

How to execute a full outer join in splunk?

rkanumula
Path Finder

Hi,

i have a indexes A and B. when i am joining both indexes with type=outer, I am getting only left index data, but I want both columns of data. How do I do this?

ex:

Index A

id  name  sal
1    x    10,000

Index B

id desgn
1  eng 

Now I want the output as:

id  name  sal     desg
1    x    10000   engineer 

This is my current search:

index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal

Thanks in advance

Tags (2)
1 Solution

rkanumula
Path Finder

Got The Solution

Query:

index=a | join type=outer[ SEARCH index=b|rename id as id_cardNum]
|where id=id_cardNum|table id,name,desg,sal

View solution in original post

rkanumula
Path Finder

Got The Solution

Query:

index=a | join type=outer[ SEARCH index=b|rename id as id_cardNum]
|where id=id_cardNum|table id,name,desg,sal

richgalloway
SplunkTrust
SplunkTrust

Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try index=a | join type=outer id [search index=b] | table id name sal desgn ?

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

How to send events & findings from AWS to Splunk using Amazon EventBridge

Amazon EventBridge is a serverless service that uses events to connect application components together, making ...

Exciting News: The AppDynamics Community Joins Splunk!

Hello Splunkers,   I’d like to introduce myself—I’m Ryan, the former AppDynamics Community Manager, and I’m ...

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...