Splunk Search
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: Differences between join and lookup
Options
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
changwoo
Communicator
01-15-2014
10:16 PM
1 Solution
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
01-15-2014
10:26 PM
Hi changwoo,
A join is used to combine the results of a search and subsearch if specified fields are common to each. You can also join a table to itself using the selfjoin command.
Use the lookup command to manually invoke field lookups from a lookup table that you've defined in transforms.conf. For more information, see "Lookup fields from external data sources," in the Knowledge Manager manual.
hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bing_wu_mash
Explorer
10-15-2014
04:25 PM
Also - if you are from DB/SQL background, keep in mind LOOKUP is like LEFT OUTER JOIN whereas JOIN is like INNER JOIN. The results are quite different
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
highsplunker
Contributor
03-21-2023
09:29 AM
excellent. this is exactly what's important.
i'd also add this: there's No difference between "left join" and "left OUTER join".
ref. https://stackoverflow.com/questions/406294/left-join-vs-left-outer-join-in-sql-server
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
bing_wu_mash
Explorer
10-15-2014
04:24 PM
Also - if you are from DB/SQL background, keep in mind LOOKUP is like LEFT OUTER JOIN whereas JOIN is like INNER JOIN
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
MuS
Legend
01-15-2014
10:26 PM
Hi changwoo,
A join is used to combine the results of a search and subsearch if specified fields are common to each. You can also join a table to itself using the selfjoin command.
Use the lookup command to manually invoke field lookups from a lookup table that you've defined in transforms.conf. For more information, see "Lookup fields from external data sources," in the Knowledge Manager manual.
hope this helps ...
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
changwoo
Communicator
01-15-2014
11:01 PM
thanks for your help
Get Updates on the Splunk Community!
.conf25 Registration is OPEN!
Ready. Set. Splunk!
Your favorite Splunk user event is back and better than ever. Get ready for more technical ...
Detecting Cross-Channel Fraud with Splunk
This article is the final installment in our three-part series exploring fraud detection techniques using ...
Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside
Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...
