https://community.splunk.com/t5/Splunk-Search/How-to-join-inner/m-p/618244#M214864 <P>Inter join is not displaying any results.&nbsp; &nbsp;the search works however, nothing is showing up on the screen</P> <P>index = tenable | rename hostnames as host.name | table host.name | join type=inner host.name [search (index=assetpanda) | fields host.name] | table host.name</P> Tue, 25 Oct 2022 14:02:58 GMT marceldera 2022-10-25T14:02:58Z https://community.splunk.com/t5/Splunk-Search/How-to-join-inner/m-p/618244#M214864 <P>Inter join is not displaying any results.&nbsp; &nbsp;the search works however, nothing is showing up on the screen</P> <P>index = tenable | rename hostnames as host.name | table host.name | join type=inner host.name [search (index=assetpanda) | fields host.name] | table host.name</P> Tue, 25 Oct 2022 14:02:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-inner/m-p/618244#M214864 marceldera 2022-10-25T14:02:58Z https://community.splunk.com/t5/Splunk-Search/How-to-join-inner/m-p/618246#M214866 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/232122">@marceldera</a>,</P><P>I suppose that you already checked that there are matching values!</P><P>Anyway, the problem is probably in the limit of 50,000 values of the subsearch.</P><P>So you need to limit the values of the subsearch or (better!) use a different approach!</P><P>please the approach and adpt it to your need:</P><LI-CODE lang="markup">index = tenable OR index=assetpanda | eval hostname=coalesce(hostname,host.name) | stats dc(index) AS index_count values(index) AS index BY hostname | where index_count=2 | table hostname</LI-CODE><P>in general, avoid to use fields with spaces or special chars as dot.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 25 Oct 2022 13:47:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-join-inner/m-p/618246#M214866 gcusello 2022-10-25T13:47:58Z