https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531807#M150218 <P>index=105261-cli sourcetype=show_processes_cpu pid=0<BR />| dedup deviceId<BR />| fields deviceId, idle, fiveMinutes<BR />| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))<BR />| join deviceId<BR />[ search index=105261-np sourcetype=device_details<BR />| fields deviceId, deviceName, productFamily, swVersion ]<BR />| eval Status=if((cpuLoad &lt;85 ), "OK" , "Not OK" )<BR />| table deviceName, productFamily, cpuLoad, swVersion, Status<BR />| sort - cpuLoad</P> Thu, 03 Dec 2020 04:52:47 GMT pstalin_ 2020-12-03T04:52:47Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531807#M150218 <P>index=105261-cli sourcetype=show_processes_cpu pid=0<BR />| dedup deviceId<BR />| fields deviceId, idle, fiveMinutes<BR />| eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes))<BR />| join deviceId<BR />[ search index=105261-np sourcetype=device_details<BR />| fields deviceId, deviceName, productFamily, swVersion ]<BR />| eval Status=if((cpuLoad &lt;85 ), "OK" , "Not OK" )<BR />| table deviceName, productFamily, cpuLoad, swVersion, Status<BR />| sort - cpuLoad</P> Thu, 03 Dec 2020 04:52:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531807#M150218 pstalin_ 2020-12-03T04:52:47Z https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531810#M150220 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/229380">@pstalin_</a>&nbsp;</P><P>This query might do the trick. I believe your dedup will in practice get the most recent event from the cli index for that device, hence the use of latest(*)</P><LI-CODE lang="markup">(index=105261-cli sourcetype=show_processes_cpu pid=0) OR (index=105261-np sourcetype=device_details) | fields deviceId, idle, fiveMinutes deviceId, deviceName, productFamily, swVersion | stats latest(*) as * by deviceId | eval cpuLoad = round(if(isnull(fiveMinutes), 100-idle, fiveMinutes)) | eval Status=if((cpuLoad &lt;85 ), "OK" , "Not OK" ) | table deviceName, productFamily, cpuLoad, swVersion, Status | sort - cpuLoad</LI-CODE><P>but this</P><UL><LI>making the two combined searches</LI><LI>limiting fields to those needed from either search</LI><LI>using stats to 'join' the two data sets with latest(*) as * to handle all fields</LI><LI>then doing your post search calcs</LI></UL><P>Hope this helps.</P><P>&nbsp;</P> Thu, 03 Dec 2020 05:06:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-replace-join-command-with-any-other-alternative-command/m-p/531810#M150220 bowesmana 2020-12-03T05:06:50Z