Hello, I'm trying to do an outer join, but without actually using a join,
I have a lookup with names and based on these names, I need to perform the search and return all values on the lookup, even if they were not found on the search. For example:
lookup
name
a
b
c
d
e
f
g
search
name | number
a | 12:34:56
b | 09:87:76
e | 45:23:65
So, the result should be something like:
a | 12:34:56
b | 09:87:76
c | Not found
d | Not found
e | 45:23:65
f | Not found
g | Not found
This is my search so far which is working, but I dont want to use join, because it takes sooo long to complete because a big amount of events:
| inputlookup my_names.csv | fields Name | rename Name as names
| join type=left names[search index=my_index sourcetype=my_st names=* | fields number names
| dedup names
| stats latest(number) by names
Thanks in advance.
... View more