<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: join is skipping rows in Getting Data In</title>
    <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451162#M78243</link>
    <description>&lt;P&gt;yes correct, i have used it the same same.&lt;BR /&gt;
i get results for some records from the file and some i do not..&lt;/P&gt;</description>
    <pubDate>Fri, 10 May 2019 14:39:41 GMT</pubDate>
    <dc:creator>jiaqya</dc:creator>
    <dc:date>2019-05-10T14:39:41Z</dc:date>
    <item>
      <title>join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451158#M78239</link>
      <description>&lt;P&gt;csv files has 70k entries and when i join it with index which has 30k rows, it fails to join random records even when data is available.&lt;/P&gt;

&lt;P&gt;when i specify the record before and after join it picks up the value.&lt;/P&gt;

&lt;P&gt;any idea if this is due to any kind of limitation.&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:18:17 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451158#M78239</guid>
      <dc:creator>jiaqya</dc:creator>
      <dc:date>2019-05-10T14:18:17Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451159#M78240</link>
      <description>&lt;P&gt;Which form of join are you using?  Please share your query.&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:33:28 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451159#M78240</guid>
      <dc:creator>richgalloway</dc:creator>
      <dc:date>2019-05-10T14:33:28Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451160#M78241</link>
      <description>&lt;P&gt;join type=left  [|inputlookup  &lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:36:36 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451160#M78241</guid>
      <dc:creator>jiaqya</dc:creator>
      <dc:date>2019-05-10T14:36:36Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451161#M78242</link>
      <description>&lt;P&gt;You need to put the "KEY" which are you joining upon&lt;/P&gt;

&lt;P&gt;so&lt;BR /&gt;
    | join type=left  COMMONKEY [|inputlookup ..&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:37:54 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451161#M78242</guid>
      <dc:creator>koshyk</dc:creator>
      <dc:date>2019-05-10T14:37:54Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451162#M78243</link>
      <description>&lt;P&gt;yes correct, i have used it the same same.&lt;BR /&gt;
i get results for some records from the file and some i do not..&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:39:41 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451162#M78243</guid>
      <dc:creator>jiaqya</dc:creator>
      <dc:date>2019-05-10T14:39:41Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451163#M78244</link>
      <description>&lt;P&gt;@jiaqya It may be due to subsearch limitation of 10K records, hence your join subsearch is not returning all records. You should try avoiding the join and use lookup command instead.&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 14:57:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451163#M78244</guid>
      <dc:creator>Vijeta</dc:creator>
      <dc:date>2019-05-10T14:57:56Z</dc:date>
    </item>
    <item>
      <title>Re: join is skipping rows</title>
      <link>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451164#M78245</link>
      <description>&lt;P&gt;Join is subject to subsearch and RAM limits.  Do not use it.  Use &lt;CODE&gt;... | stats values(*) AS * BY &amp;lt;joinerfield here&amp;gt;&lt;/CODE&gt; instead.&lt;/P&gt;</description>
      <pubDate>Fri, 10 May 2019 20:09:16 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Getting-Data-In/join-is-skipping-rows/m-p/451164#M78245</guid>
      <dc:creator>woodcock</dc:creator>
      <dc:date>2019-05-10T20:09:16Z</dc:date>
    </item>
  </channel>
</rss>

