Join is not returning events if subsearch is empty. How to fix it

[denissotoacc]

I have an Index called myindex:

NAME	AGE	CITY	COUNTRY	LEGAL AGE
Denis	17	London	UK	NO
Denis	18			YES
Maria	17	Rosario	Argentina	NO
Maria	18			YES
Nani	11	Paris	France	NO

This is a basic example. The case is when LEGAL AGE=NO, there are several more fields available than when LEGAL AGE=YES. Notice that when LEGAL AGE=YES the field "CITY" and "COUNTRY" didn't exists at all.

What I need to get are all the people of this index with all the information EVEN if they are not in LEGAL AGE.

I use a join for this:

index=myindex "LEGAL AGE"=NO
| join NAME
        [ search index=myindex "LEGAL AGE"=YES ]

The problem is that it is working only if the subsearch returns something. In this example, it will work for Denis and Maria, but not for Nani. How can I make it works even if subsearch is returning nothing?

[richgalloway · Accepted solution]

I think the problem is the join command defaults to an inner join.  Try join type=outer NAME ...