Search result in Join Not returning all the result in second result set

[karunagaraprabh]

i have two queries where each queries return two rows as result . I am join two queries using left join which have common field as customerjobid.  when i run the quires, the result set fetch only second quires  result of first row.

[scelikok · Accepted solution]

Hi @karunagaraprabh ,

join command joins only first event on subsearch results that each main search result can join as default. You should use "max" parameter to match more results.

| join CustomerjobId type=left max=2

You can find more info about "max" parameter below;

https://docs.splunk.com/Documentation/Splunk/8.1.1/SearchReference/Join#Optional_arguments

If this reply helps you an upvote is appreciated.