i have a indexes A and B. when i am joining both indexes with type=outer, I am getting only left index data, but I want both columns of data. How do I do this?
id name sal
1 x 10,000
Now I want the output as:
id name sal desg
1 x 10000 engineer
This is my current search:
index=a | join type=outer a.id[ SEARCH index=b]|table id,name,desg,sal
Thanks in advance
Maybe it's a typo, but Splunk joins aren't the same as SQL joins. Did you try index=a | join type=outer id [search index=b] | table id name sal desgn ?
index=a | join type=outer id [search index=b] | table id name sal desgn
Got The Solution
index=a | join type=outer[ SEARCH index=b|rename id as idcardNum]
|where id=idcardNum|table id,name,desg,sal
View solution in original post