topic How to combine a search with a data model without the JOIN operator? in Splunk Search https://community.splunk.com/t5/Splunk-Search/How-to-combine-a-search-with-a-data-model-without-the-JOIN/m-p/294995#M89026 <P>Hi experts,</P> <P>I try to combine a normal search with a data model without the JOIN operator, because of the slow processing speed and the subsearch result limitation of 50.000 results per search. </P> <P>I read in the .conf 2016 session by Nick Mealy (<A href="https://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf">https://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf</A>) that this not possible because the data model command is a generating command. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>Does anybody has a solution or face the same problem? I think it is really important to combine a data model and normal searches in a efficient way.</P> <P>Kind regards,<BR /> Christopher</P> Thu, 12 Oct 2017 09:28:57 GMT christopherwern 2017-10-12T09:28:57Z How to combine a search with a data model without the JOIN operator? https://community.splunk.com/t5/Splunk-Search/How-to-combine-a-search-with-a-data-model-without-the-JOIN/m-p/294995#M89026 <P>Hi experts,</P> <P>I try to combine a normal search with a data model without the JOIN operator, because of the slow processing speed and the subsearch result limitation of 50.000 results per search. </P> <P>I read in the .conf 2016 session by Nick Mealy (<A href="https://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf">https://conf.splunk.com/files/2016/slides/let-stats-sort-them-out-building-complex-result-sets-that-use-multiple-source-types.pdf</A>) that this not possible because the data model command is a generating command. <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> <P>Does anybody has a solution or face the same problem? I think it is really important to combine a data model and normal searches in a efficient way.</P> <P>Kind regards,<BR /> Christopher</P> Thu, 12 Oct 2017 09:28:57 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-a-search-with-a-data-model-without-the-JOIN/m-p/294995#M89026 christopherwern 2017-10-12T09:28:57Z Re: How to combine a search with a data model without the JOIN operator? https://community.splunk.com/t5/Splunk-Search/How-to-combine-a-search-with-a-data-model-without-the-JOIN/m-p/294996#M89027 <P>There are a number of strategies. The top two are multisearch and append.</P> <P><STRONG>MULTISEARCH</STRONG></P> <PRE><CODE>| multisearch [ search with all streaming distributed commands] [ | datamodel search with all streaming distributed commands] | rename COMMENT as "Commands that are not streaming go here and operate on both subsets." </CODE></PRE> <P><STRONG>APPEND</STRONG></P> <PRE><CODE>my first search | append [| my datamodel search ] | rename COMMENT as "More commands that operate on both subsets." </CODE></PRE> Thu, 12 Oct 2017 15:45:52 GMT https://community.splunk.com/t5/Splunk-Search/How-to-combine-a-search-with-a-data-model-without-the-JOIN/m-p/294996#M89027 DalJeanis 2017-10-12T15:45:52Z