help me with join condition

[sravankaripe]

i have two indexes i have Sid common in both

i want to display Sid and Did in a table.
Please help me with join condtion.

[somesoni2]

How about this? (will keep events with sid common and sid only in index=B, the right outer join)

index=A OR index=B | stats value(did) as did values(index) as indexes by sid | where isnotnull(mvfind(indexes,"B"))

[somesoni2]

Is there a common field between those two indexes? If I understand correctly you're trying to get what a SQL right outer join will give, is it correct?

[sravankaripe]

Sid is a common field.
Yes, it is similar like SQL Right join .

[jkat54 · Accepted solution]

index=index2 sid=* | join type=left sid [search index=index1 sid=* | fields sid ] | table sid did

This assumes index2 has sid & did, and index1 has just sid

Basically mirror your image and follow the docs: http://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/SearchReference/Join

[sravankaripe]

index=index2 sid=* | join type=left sid [search index=index1 sid=* ] | table sid did

this is working