How do I split the output of the join in Splunk

[arungeorge09]

I have a splunk join between a synchornous event and an asynchornous event. The only join condition between these are just a correlation id. I am able to get the join but I want to now know what are the actual reason which caused it and would like to see the part of a join . How do I do that.

index=xyz platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=xyz event=cloudPns*  ] | stats count by responseCode

Now if the responseCode is 8 then I have a problem but I want to see all the events with event=cloudPns* alone for this join condition .

I tried where but it gave me 0 results.
what I tried is this:

index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns*  ] |search where event=cloudPns*

How do I achieve this . I basically want to see the output of the right part of the join.

[lquinn]

Using the join command will literally join events together so you cannot then search only for part of an event. If you wanted to return the raw event from the righthand join you could maybe rename the _raw field before the join and then table it like this:

 index=qa-speed platform=apns batch=496 event="NEAT-IN"  | join type=outer alertId [ search index=qa-speed event=cloudPns* | rename _raw AS rawEvent ] | table rawEvent