topic Re: Replacement for Join in Splunk Search

Replacement for Join

ryanprayacn — Mon, 25 Sep 2017 11:06:41 GMT

The below example provides the output I need, but I will exceed the JOIN command limitations (50k). Can someone advise on a different way to accomplish the join below - without using the JOIN command?

So as an example:

Primary Table
Customer 1, 2, 3

Secondary Table
Customer 1,2,3,2
Spend 100, 200, 300, 400

Search: index=primary | join type=left max=0 Customer [search index=secondary] | table Customer Spend

Output is
Customer 1, 2, 2, 3
Spend 100, 200, 400, 300

Re: Replacement for Join

gcusello — Mon, 25 Sep 2017 11:14:04 GMT

Hi ryanprayacn,
could you share more details and examples?
watching your example, it seems that you don't need Primary table, you only need to show in a table values of Secondary Table in a different order!
Bye.
Giuseppe

Re: Replacement for Join

ryanprayacn — Mon, 25 Sep 2017 11:18:32 GMT

Please assume that you must join the tables. Just trying to provide a simple example. Thanks!