SQL-like joining of results from the main results pipeline with the results from the subpipeline.
join [join-options]* <field-list> [ subsearch ]
- Description: A search pipeline. Read more about how subsearches work in the User manual.
- Syntax: <field>, ...
- Description: Specify the exact fields to use for the join. If none are specified, uses all fields that are common to both result sets.
- Syntax: type=(inner|outer|left) | usetime=<bool> | earlier=<bool> | overwrite=<bool> | max=<int>
- Description: Options to the join command.
- Syntax: type=inner | outer | left
- Description: Indicates the type of join to perform. Basically, the difference between an
outer) join is how they treat events in the main pipeline that do not match any in the subpipeline. In both cases, events that match are joined. The results of an
innerjoin will not include any events with no matches. A
outer) join does not require each event to have matching field values; and the joined result retains each event—even if there is no match with any rows of the subsearch. Defaults to inner.
- Syntax: usetime=<bool>
- Description: Indicates whether to limit matches to sub-results that are earlier or later than the main result to join with. Defaults to false.
- Syntax: earlier=<bool>
- Description: If
usetime=true, specify whether to join with matches that are earlier (true) or later (false) than the main result. Defaults to true.
- Syntax: overwrite=<bool>
- Description: Indicates if fields from the sub results should overwrite those from the main result if they have the same field name. Defaults to true.
- Syntax: max=<int>
- Description: Indicates the maximum number of sub-results each main result can join with. If
max=0, means no limit. Defaults to 1.
Traditional join command that joins results from the main results pipeline with the results from the search pipeline provided as the last argument. Optionally specifies the exact fields to join on. If no fields specified, will use all fields that are common to both result sets.
Example 1: Joins previous result set with results from 'search foo', on the id field.
... | join id [search foo]
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the join command.
This documentation applies to the following versions of Splunk® Enterprise: 4.3, 4.3.1, 4.3.2, 4.3.3, 4.3.4, 4.3.5, 4.3.6, 4.3.7