https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416565#M119886 <P>Get rid of those <CODE>| table first_table</CODE> and <CODE>| table second_table</CODE>. The table command is to selectively show the fields from result of the search, so your current searches are trying to return fields 'first_table' and 'second_table' which do not exist and join fails.</P> Wed, 30 Sep 2020 00:10:32 GMT somesoni2 2020-09-30T00:10:32Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416564#M119885 <P>Hello, I am trying to use the join by userid on 2 different sub queries using join feature, both the queries are returning the data when individually ran, but is not returning the data when used with join, what is missing in query below to join by userid ?</P> <PRE><CODE>earliest=-1h sourcetype=GATEWAY | stats count by UserId , cc.Type, Error.Code | table first_table | join UserId [ | search earliest=-1h sourcetype=GATEWAY ReasonCode="Authorized"| stats count by UserId , cc.Type| table second_table] </CODE></PRE> Mon, 15 Apr 2019 23:18:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416564#M119885 msrama5 2019-04-15T23:18:09Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416565#M119886 <P>Get rid of those <CODE>| table first_table</CODE> and <CODE>| table second_table</CODE>. The table command is to selectively show the fields from result of the search, so your current searches are trying to return fields 'first_table' and 'second_table' which do not exist and join fails.</P> Wed, 30 Sep 2020 00:10:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416565#M119886 somesoni2 2020-09-30T00:10:32Z https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416566#M119887 <P>Start with this:</P> <PRE><CODE>earliest=-1h sourcetype=GATEWAY | stats count count(eval(ReasonCode="Authorized")) BY UserId , cc.Type, Error.Code </CODE></PRE> Tue, 16 Apr 2019 15:14:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-use-join-using-stats-by-count-on-two-different-searches/m-p/416566#M119887 woodcock 2019-04-16T15:14:54Z