Splunk Search

Splunk Join is Left the same as outer in Splunk?

robertlynch2020
Influencer

Is Type=Left the same as type=outer in Splunk?

 

If so why do they list it as three options?

https://docs.splunk.com/Documentation/Splunk/8.0.4/SearchReference/Join

type Syntax: type=inner | outer | left Description: Indicates the type of join to perform. The difference between an inner and a left (or outer) join is how the events are treated in the main search that do not match any of the events in the subsearch. In both inner and left joins, events that match are joined. The results of an inner join do not include events from the main search that have no matches in the subsearch. The results of a left (or outer) join includes all of the events in the main search and only those values in the subsearch have matching field values. Default: inner

 
Labels (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Left and outer are synonymous 

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Left and outer are synonymous 

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...