inverse join in Splunk

[jonthanze]

I have a search between two data sets using join, let's say sourcetype A and B.

My search looks like this:



sourcetype=A fieldA |eval fieldB=fieldA|join fieldB [search sourcetype=B fieldB]

The results i am receiving is the list of all the events where fieldA in A is the same as fieldB in B.

What I am trying to receive is the list of fieldA that doesn't exist in B.

Can someone please help me with this ?

Regards,

Jonathann

[linu1988]

Try to have join type left, which will give all the details.

sourcetype=A fieldA |eval fieldB=fieldA|join type=left fieldB [search sourcetype=B fieldB]

Thanks

[brandonhough]

This worked perfectly. Thank you!!