I actually need a right join in some cases.
I know im not supposed to use joins at all, and wherever possible use a disjunction plus stats, or use a lookup, because these are faster, better, chea...
See more...
I actually need a right join in some cases.
I know im not supposed to use joins at all, and wherever possible use a disjunction plus stats, or use a lookup, because these are faster, better, cheaper, awesomer etc.
(http://answers.splunk.com/questions/822/simulating-a-sql-join-in-splunk/1717#1717)
However sometimes there's just no other way. One side of my data comes from a search and the other side comes from inputlookup. So i cant just glue together two sets of 'events' in a single search with some OR's and stitch them back together with stats count by foo later. .
Anyway, proceeding with join, I have 2 searches that return events with a field called sourceHost
search <somewhat expensive search>
inputlookup foo.csv
Following best practices with join, the cheaper smaller search goes inside the brackets:
search <somewhat expensive search> | join common_field [inputlookup foo.csv]
"inner" is the default type, so if rows are in left side and not in the right side, or in the right side and not on the left side, they'll be dropped.
the docs say that type="outer" and type="left" are synonymous.
http://www.splunk.com/base/Documentation/latest/SearchReference/Join
and as far as I can tell there's no type="right". Is there another way?