Return results if join has no results.

[becksyboy]

Hi all,

I have a search with a Join. For the event I am Joining the Master search may not always have corresponding events in the join/subsearch. 

Is it possible to also return the results from the master search if the join does not find corresponding events?

index=*azure* *#EXT#* Operation="Add member to group."
|spath output=groupname path=ModifiedProperties{1}.NewValue
|spath output=TID path=Target{1}.ID 
|eval time=strftime(_time,"%H:%M:%S %d-%m-%Y")
|rename UserId as src_user
|stats earliest(time) as start_time latest(time) as last_time values(Operation) as operation values(ObjectId) as dest_user by groupname,src_user, TID
|  rename operation AS operation1
| table start_time, last_time, operation1, groupname, src_user, dest_user, TID
| join TID 
    [search index=*o365*
|spath output=TID path=Parameters{1}.Value
|eval time=strftime(_time,"%H:%M:%S %d-%m-%Y")
|rename UserId as src_user
|stats earliest(time) as start_time latest(time) as last_time values(Operation) as operation  values(ObjectId) as dest_group by src_user, TID]
|table start_time, last_time, src_user, operation, operation1, dest_group, groupname, dest_user TID

[gcusello · Accepted solution]

Hi @becksyboy ,

only to answer to your question: as you can read at https://help.splunk.com/en/splunk-enterprise/spl-search-reference/9.2/search-commands/join#id_62219e... try with 

type=left

to perform a left join.

Anyway, try to avoid to use the join command that's very slow, try to correlate events using stats.

Ciao.

Giuseppe

[becksyboy]

Thanks this works perfectly, i will read the link.