Hi,
I have an Index=A and inputlookfile where I'm trying to get a list of computers which are not common in 'index =A and Inputlook file B, I tried to do a left join on the 'computer' name from index =A on input look file , but I'm not getting the desired result.
Could you please let me know if we can do a left outer join in spunk to get the resultset which is not common in both the index OR lookup file?
--Thanks
Is this OK?
(A) ※(outer | left)JOIN
index =A |join type=outer computer [|inputlookup B]
(A NOT B)
index =A NOT [|inputlookup B|fields computer]
(A AND B)
index =A |join type=inner computer [|inputlookup B]
OR
index =A [|inputlookup B|fields computer]
(A OR B)
index =A |append [|inputlookup B]
(When making it unique)
・・・・・ |stats latest(*) AS * BY computer
OR
・・・・・ |dedup computer
I tried the above solutions and it didnt work.
Can you present samples of search statements and lookup files?