https://community.splunk.com/t5/Splunk-Search/Issue-with-parsing-large-dataset-using-Join/m-p/479770#M134466 <P>Hello,<BR /> I am using the following search to parse 2 indexes since I want to combine the results from both indexes based on common field "email". I am running this search on my local Splunk instance and both indexes are uploaded CSV. I have configured limits.conf file to handle large dataset. I get different output for Clicked_link and delivered_email when I use the OR operator in the Join versus when I just use either of them I get the correct output. Am I missing something here. Why is the OR operator trimming output result. I see 0 output for bunch of tables when normally it is populated with some number.</P> <P>index=IndexA<BR /> | join type=inner email [ search index=IndexB ( event=delivered OR event=click ) | dedup email event | fields email, event ]<BR /> | stats count(eval('event'="delivered")) as Email_Delivered<BR /> count(eval('event'="click")) as Clicked_links<BR /> by Region, Division, Country, Location<BR /> | table Region, Division, Country, Location, "Email_Delivered" , Clicked_links</P> Wed, 30 Sep 2020 02:10:28 GMT kiranpatil1985 2020-09-30T02:10:28Z https://community.splunk.com/t5/Splunk-Search/Issue-with-parsing-large-dataset-using-Join/m-p/479770#M134466 <P>Hello,<BR /> I am using the following search to parse 2 indexes since I want to combine the results from both indexes based on common field "email". I am running this search on my local Splunk instance and both indexes are uploaded CSV. I have configured limits.conf file to handle large dataset. I get different output for Clicked_link and delivered_email when I use the OR operator in the Join versus when I just use either of them I get the correct output. Am I missing something here. Why is the OR operator trimming output result. I see 0 output for bunch of tables when normally it is populated with some number.</P> <P>index=IndexA<BR /> | join type=inner email [ search index=IndexB ( event=delivered OR event=click ) | dedup email event | fields email, event ]<BR /> | stats count(eval('event'="delivered")) as Email_Delivered<BR /> count(eval('event'="click")) as Clicked_links<BR /> by Region, Division, Country, Location<BR /> | table Region, Division, Country, Location, "Email_Delivered" , Clicked_links</P> Wed, 30 Sep 2020 02:10:28 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-parsing-large-dataset-using-Join/m-p/479770#M134466 kiranpatil1985 2020-09-30T02:10:28Z https://community.splunk.com/t5/Splunk-Search/Issue-with-parsing-large-dataset-using-Join/m-p/479771#M134467 <P>Hi kiranpatil1985,<BR /> there is a limit of 50,000 results in subsearches, for this reason and because join command is very very slow, I suggest to approach this problem in a different way, using stats command.</P> <PRE><CODE>index=IndexA OR index=IndexB ( event=delivered OR event=click ) | dedup email event | fields email, event ] | stats count(eval('event'="delivered")) as Email_Delivered count(eval('event'="click")) as Clicked_links BY email Region, Division, Country, Location | table Region, Division, Country, Location, "Email_Delivered" , Clicked_links </CODE></PRE> <P>Bye.<BR /> Giuseppe</P> Thu, 12 Sep 2019 08:51:58 GMT https://community.splunk.com/t5/Splunk-Search/Issue-with-parsing-large-dataset-using-Join/m-p/479771#M134467 gcusello 2019-09-12T08:51:58Z