topic Re: avoid join in Splunk Search

Can I search without using join?

mcaulsc — Mon, 05 Jun 2023 14:15:53 GMT

Hi,
I'm looking to improve performance and avoid the subsearch_maxout issue with a join on two source types.

I'm joining on a one to many field 'Correlator', srctypeA has will have one unique entry for 'Correlator' and srctypeB has multiple entries. So when my search on srctypeA returns a value for Correlator I want to timechart by a field in records with matching Correlator in srctypeB.

So the current search below works, I'm looking for better performing options if anyone has any suggestions.

index=index1 sourcetype=srctypeA field1=ABC* | join max=0 type=inner Correlator [ search index=index1 sourcetype=srctypeB ] | timechart span=1d count by field2

Re: avoid join

isoutamo — Fri, 02 Jun 2023 13:20:27 GMT

I hope that this will help you: https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-join-and-the/m-p/391288/thread-id/113948

r. Ismo

Re: avoid join

mcaulsc — Fri, 02 Jun 2023 14:23:24 GMT

thanks,
thats is what I have been attempting and I get to the stats point ok with 121k events returned but trying to get the data into a timechart is eluding me at the moment.

Re: avoid join

isoutamo — Fri, 02 Jun 2023 18:56:25 GMT

Join has those limits (size of result set and timeout), which probably hits in your case.

Have you try Woodcock’s inner join example with stats and where? I suppose that it should help you.