Splunk Search
Highlighted

How to execute a full outer join in splunk?

Path Finder

Hi,

i have a indexes A and B. when i am joining both indexes with type=outer, I am getting only left index data, but I want both columns of data. How do I do this?

ex:

Index A

id  name  sal
1    x    10,000

Index B

id desgn
1  eng 

Now I want the output as:

id  name  sal     desg
1    x    10000   engineer 

This is my current search:

index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal

Thanks in advance

Tags (2)
Highlighted

Re: How to execute a full outer join in splunk?

SplunkTrust
SplunkTrust

Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try index=a | join type=outer id [search index=b] | table id name sal desgn ?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to execute a full outer join in splunk?

Path Finder

Got The Solution

Query:

index=a | join type=outer[ SEARCH index=b|rename id as idcardNum]
|where id=id
cardNum|table id,name,desg,sal

View solution in original post