https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24242#M4405 <P>The search string shown below returns valid results when run in Splunk 4.3.4 but it doesn't in Splunk 5.0.</P> <P>index=agent MTRn |fields MTRn S| join S [search svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site</P> <P>The result shows empty values for the "MTRn" column and the "S" and "site" columns show data from the subsearch. </P> <P>Cheers, </P> Thu, 07 Feb 2013 22:35:09 GMT jamercadoh 2013-02-07T22:35:09Z https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24242#M4405 <P>The search string shown below returns valid results when run in Splunk 4.3.4 but it doesn't in Splunk 5.0.</P> <P>index=agent MTRn |fields MTRn S| join S [search svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site</P> <P>The result shows empty values for the "MTRn" column and the "S" and "site" columns show data from the subsearch. </P> <P>Cheers, </P> Thu, 07 Feb 2013 22:35:09 GMT https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24242#M4405 jamercadoh 2013-02-07T22:35:09Z https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24243#M4406 <P>Your inner search is an entirely separate and unrelated search from the outer search, so it needs to also include the index to search: ie:</P> <PRE><CODE>index=agent MTRn |fields MTRn S| join S [search index=agent svc="*"| fields svc, sessionId Site | rename sessionId AS S]|table MTRn S Site </CODE></PRE> Fri, 08 Feb 2013 00:00:30 GMT https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24243#M4406 Ron_Naken 2013-02-08T00:00:30Z https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24244#M4407 <P>The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail. </P> Fri, 08 Feb 2013 18:51:47 GMT https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24244#M4407 jamercadoh 2013-02-08T18:51:47Z https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24245#M4408 <P>The sub-search searches data in the "main" index whereas the outer does it in the "agent" index. I tried to include the index=main clause to no avail.</P> Fri, 08 Feb 2013 20:48:24 GMT https://community.splunk.com/t5/Splunk-Search/The-Join-command-doesn-t-combine-results-from-different-indexes/m-p/24245#M4408 jamercadoh 2013-02-08T20:48:24Z