https://community.splunk.com/t5/Splunk-Search/Why-does-the-index-order-change-the-amount-of-results-returned/m-p/284916#M86169 <P>Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?<BR /> [join]<BR /> subsearch_maxout = 50000<BR /> subsearch_maxtime = 60<BR /> subsearch_timeout = 120</P> <P>?</P> <P>BTW, you also may want to remove the <CODE>table Id</CODE> or replace it with <CODE>fields Id</CODE> (unrelated, but more efficient).</P> Tue, 29 Sep 2020 08:43:07 GMT s2_splunk 2020-09-29T08:43:07Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-index-order-change-the-amount-of-results-returned/m-p/284915#M86168 <P>Search: </P> <PRE><CODE>index="A" |dedup Id | table Id | join max=0 type=inner Id [search index="B" ]| stats count(Id) </CODE></PRE> <P>When switching index A &amp; B, I receive more results, but it still doesn't match all of the Ids.<BR /> After checking both indexes and doing analysis on the Ids, it was found that over 6000 Ids didn't join, even though they existed in each data set.</P> Tue, 09 Feb 2016 22:04:46 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-index-order-change-the-amount-of-results-returned/m-p/284915#M86168 LWilliamson1 2016-02-09T22:04:46Z https://community.splunk.com/t5/Splunk-Search/Why-does-the-index-order-change-the-amount-of-results-returned/m-p/284916#M86169 <P>Are you hitting any of these default limits (from limits.conf), most likely, does your subsearch return more than 50000 events?<BR /> [join]<BR /> subsearch_maxout = 50000<BR /> subsearch_maxtime = 60<BR /> subsearch_timeout = 120</P> <P>?</P> <P>BTW, you also may want to remove the <CODE>table Id</CODE> or replace it with <CODE>fields Id</CODE> (unrelated, but more efficient).</P> Tue, 29 Sep 2020 08:43:07 GMT https://community.splunk.com/t5/Splunk-Search/Why-does-the-index-order-change-the-amount-of-results-returned/m-p/284916#M86169 s2_splunk 2020-09-29T08:43:07Z