topic Is there a more efficient method than using join to combine searches? in Splunk Search https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130220#M35466 <P>I was just wondering what more efficient methods there are when combining searches than using | join. I always hear everyone telling me that joins are a last resort because they aren't the most efficient way to combine searches. Any thoughts?</P> Thu, 18 Sep 2014 13:15:15 GMT bigrichie90 2014-09-18T13:15:15Z Is there a more efficient method than using join to combine searches? https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130220#M35466 <P>I was just wondering what more efficient methods there are when combining searches than using | join. I always hear everyone telling me that joins are a last resort because they aren't the most efficient way to combine searches. Any thoughts?</P> Thu, 18 Sep 2014 13:15:15 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130220#M35466 bigrichie90 2014-09-18T13:15:15Z Re: Is there a more efficient method than using join to combine searches? https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130221#M35467 <P>Hi bigrichie90,</P> <P>have a look at this answer <A href="http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html">http://answers.splunk.com/answers/129424/how-to-compare-fields-over-multiple-sourcetypes-without-join-append-or-use-of-subsearches.html</A></P> <P>cheers, MuS</P> Thu, 18 Sep 2014 13:17:03 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130221#M35467 MuS 2014-09-18T13:17:03Z Re: Is there a more efficient method than using join to combine searches? https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130222#M35468 <P>@piebob recently had me start sending out weekly featured Answers posts internally to certain teams in Splunk. Your post on alternatives to join, append and subsearches was in the first set I featured ;D</P> Wed, 24 Sep 2014 01:37:04 GMT https://community.splunk.com/t5/Splunk-Search/Is-there-a-more-efficient-method-than-using-join-to-combine/m-p/130222#M35468 ppablo 2014-09-24T01:37:04Z