Splunk Search

Join only giving fields from one of the two sourcetypes

asarolkar
Builder

All,

I have a join on the two sourcetypes setup like this ->

sourcetype="alog" -> id_number

sourcetype="blog" -> id

This is what my join looks like

sourcetype="alog" id_number=* | eval id=id_number | join id[ search sourcetype="blog" id=*| fields id]





For some reason, this join is only giving me results/fields that belong to alog.
What if I want the join to also give me all fields from blog whereever there was a match ?

I thought Splunk supported outer joins.

Any clues ?

Tags (3)
0 Karma

jonuwz
Influencer

You need to specify join type=outer

docs

Update

Just noticed - the only field you're returning from the subsearch is id : fields id

So the only fields you'll see will come from the main search.

Don't limit the fields in the subsearch

0 Karma

asarolkar
Builder

that did not seem to do the trick.

It still gave me only everything on the left that matched.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...