Append more 50k or other soluction like a join

[Michell_ctba]

Hello community. I am not able to perform a sub-search between 2 sourcetypes. The 'drm' sourcetype has 5 million events and I need to sub-search an sourcetype with 2 million events (drm_tuser). I tried with the join and append command followed by stats but I am not able to accomplish this task. Here is an example:

userId is a common field between sourcetypes.

index="ott" sourcetype="drm"

| append
[ search index=ott sourcetype=drm_tuser earliest=1]

| stats dc(sourcetype) as sourcetype values(retailerUserId) as retailerUserId values(bitrate) as bitrate by userId

Append use limit of 50k results in limits.conf, but I would not like to change the limits.conf so any other solution would be ideal

Tanks for help

[richgalloway]

Consider converting the drm_tuser sourcetype into a lookup table.

[gcusello]

Hi @Michell_ctba,

why do you want to use append? you don't need it, you can use OR!

Try something like this:

index="ott" (sourcetype="drm" OR sourcetype=drm_tuser)
| stats dc(sourcetype) as sourcetype values(retailerUserId) as retailerUserId values(bitrate) as bitrate by userId

Ciao.

Giuseppe