Join or Subsearch performance

MaryvonneMB — Tue, 29 Sep 2020 23:36:41 GMT

Hi all,

I have a performance question about "join" and "subsearch".
Even join is a ressource-guzzler command I saw that sometimes it works better than a subsearch:

for example:

Query A =>  index=my_index [search index=other_one earliest=-1d@d|fields field1 |dedup field1|table field1]
Query B => index=my_index |join type=inner max=1 field1 [search index=other_index earliest=-1d@d |fields field1 |dedup field1|table field1]

in "my_index" I have about 20 millions of datas. in "other_index" + earliest=-1d@d I have about 80 000 datas. In this case the query A is faster than query B.
But if i have more than 300 000 datas in "other_index" + earliest=-1d@d, then query B is faster query A.

Does anyone have an explanation?

Thanks 🙂

Re: Join or Subsearch performance

adonio — Fri, 15 Mar 2019 17:41:32 GMT

try this:

Query A =>  earliest=-2d@d latest=-1d@d index=my_index [search index=other_one earliest=-1d@d|fields field1 |dedup field1|table field1]
 Query B => earliest=-2d@d latest=-1d@d index=my_index |join type=inner max=1 field1 [search index=other_index earliest=-1d@d |fields field1 |dedup field1|table field1]

is there still a difference?

topic Join or Subsearch performance in Splunk Search

Join or Subsearch performance

Re: Join or Subsearch performance