Splunk Search
Highlighted

Problem with getting all non matching events with outer join

Communicator

Hello,

is there an easy possibility to get all events that have non matching field values after an outer join? Here is an example what I tried allready:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2]

This gives me all events where field Number1 and field Number2 are equal and not equal.
How can I get just these events now, where they are not equal?
Thanks for help.

C_Sparn

0 Karma
Highlighted

Re: Problem with getting all non matching events with outer join

SplunkTrust
SplunkTrust

Maybe something like this?

sourcetype=typ1 | eval Number = Number1 | eval NumberA = Number | join type=outer Number [search sourcetype= type2 | eval Number = Number2 | eval NumberB = Number] | where NumberA != NumberB
---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Problem with getting all non matching events with outer join

Communicator

This gives 0 results back. But thanks for the suggestion.

0 Karma
Highlighted

Re: Problem with getting all non matching events with outer join

Communicator

I found a solution now!
It looks like this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT Number2 = *

OR another way is this:

sourcetype=typ1 | eval Number = Number1 | join type=outer Number [search sourcetype= type2 | eval Number = Number2] |search NOT sourcetype = type2

Greetings
C_Sparn

View solution in original post