https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453076#M6359 <P>Never use <CODE>join</CODE>. It should not even exist.</P> Sat, 11 May 2019 05:07:59 GMT woodcock 2019-05-11T05:07:59Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453074#M6357 <P>When nesting two commands using join, how can I verify if the Join command is returning the value of the field. </P> <P>[code]<BR /> | join type=left ip <BR /> [<BR /> index=os s_ ip=10.x.x.x <BR /> | fields ip]</P> Fri, 10 May 2019 21:50:06 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453074#M6357 djkj957 2019-05-10T21:50:06Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453075#M6358 <P>Hi djkj957,</P> <P>Don't use <CODE>join</CODE> for reasons.</P> <P>Use a <CODE>stats</CODE> instead and you will not hit any hidden limits:</P> <PRE><CODE>[code] OR ( index=os s_ip=10.x.x.x | stats values(*) AS * by ip _time </CODE></PRE> <P>Hope this helps ...</P> <P>cheers, MuS</P> Fri, 10 May 2019 23:32:58 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453075#M6358 MuS 2019-05-10T23:32:58Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453076#M6359 <P>Never use <CODE>join</CODE>. It should not even exist.</P> Sat, 11 May 2019 05:07:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Join-command-working/m-p/453076#M6359 woodcock 2019-05-11T05:07:59Z