How to execute a full outer join in splunk?

[rkanumula]

Hi,

i have a indexes A and B. when i am joining both indexes with type=outer, I am getting only left index data, but I want both columns of data. How do I do this?

ex:

Index A

id  name  sal
1    x    10,000

Index B

id desgn
1  eng 

Now I want the output as:

id  name  sal     desg
1    x    10000   engineer 

This is my current search:

index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal

Thanks in advance

[rkanumula · Accepted solution]

Got The Solution

Query:

index=a | join type=outer[ SEARCH index=b|rename id as id_cardNum]
|where id=id_cardNum|table id,name,desg,sal

[richgalloway]

Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try index=a | join type=outer id [search index=b] | table id name sal desgn ?