Splunk Search

inverse join in Splunk

jonthanze
Explorer

I have a search between two data sets using join, let's say sourcetype A and B.

My search looks like this:



sourcetype=A fieldA |eval fieldB=fieldA|join fieldB [search sourcetype=B fieldB]

The results i am receiving is the list of all the events where fieldA in A is the same as fieldB in B.

What I am trying to receive is the list of fieldA that doesn't exist in B.

Can someone please help me with this ?

Regards,

Jonathann

Tags (3)
0 Karma

linu1988
Champion

Try to have join type left, which will give all the details.

sourcetype=A fieldA |eval fieldB=fieldA|join type=left fieldB [search sourcetype=B fieldB]

Thanks

0 Karma

brandonhough
New Member

This worked perfectly. Thank you!!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...