Can I search without using join?

[mcaulsc]

Hi,
I'm looking to improve performance and avoid the subsearch_maxout issue with a join on two source types.

I'm joining on a one to many field 'Correlator', srctypeA has will have one unique entry for 'Correlator' and srctypeB has multiple entries. So when my search on srctypeA returns a value for Correlator I want to timechart by a field in records with matching Correlator in srctypeB.

So the current search below works, I'm looking for better performing options if anyone has any suggestions.

index=index1 sourcetype=srctypeA field1=ABC* 
| join max=0 type=inner Correlator [ search index=index1 sourcetype=srctypeB ]
| timechart span=1d count by field2 

[isoutamo]

Hi

I hope that this will help you: https://community.splunk.com/t5/Splunk-Search/What-is-the-relation-between-the-Splunk-inner-left-joi...

r. Ismo

[mcaulsc]

thanks,
thats is what I have been attempting and I get to the stats point ok with 121k events returned but trying to get the data into a timechart is eluding me at the moment.  

[isoutamo]

Join has those limits (size of result set and timeout), which probably hits in your case.

Have you try Woodcock’s inner join example with stats and where? I suppose that it should help you.