Search result in Join Not returning all the result in second result set

karunagaraprabh — Wed, 06 Jan 2021 14:40:19 GMT

i have two queries where each queries return two rows as result . I am join two queries using left join which have common field as customerjobid. when i run the quires, the result set fetch only second quires result of first row.

Re: Search result in Join Not returning all the result in second result set

scelikok — Wed, 06 Jan 2021 09:00:49 GMT

Hi @karunagaraprabh ,

join command joins only first event on subsearch results that each main search result can join as default. You should use "max" parameter to match more results.

| join CustomerjobId type=left max=2

You can find more info about "max" parameter below;

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Join#Optional_arguments

If this reply helps you an upvote is appreciated.

topic Re: Search result in Join Not returning all the result in second result set in Splunk Dev

Search result in Join Not returning all the result in second result set

Re: Search result in Join Not returning all the result in second result set