Hi,
I'm wondering if it's possible to do an outer/left join two tables on two fields. I have two indexes with the following data:
Index1:
col1 col2
123 abc
456 def
Index2:
col1 col2 col3
123 abc xyz
Desired results:
col1 col2 col3
123 abc xyz
456 def
Here's my search:
index=index1
|join type=outer col1, col2
[search index=index2
|fields col1, col2, col3]
|table col1, col2, col3
The results I get are inconsistent. It seems almost as if Splunk is going the outer join on the two columns independently, so I get more results than I need. If I remove the "type=outer", making it an inner join, I get the below results, so I know the join works for the inner:
col1 col2 col3
123 abc xyz
Thanks,
AP
... View more